parse haproxy log message with syslog-ng

haproxy.conf

global
  daemon
  maxconn 3000

defaults
  timeout connect 10s
  timeout client 30s
  timeout server 30s

  mode http

  option httplog

  log global
  log 127.0.0.1:514 len 65535 format rfc5424 local2
  log-format '%{+Q}o {"bytes_read": %B, "bytes_uploaded": %U, "http_version": %HV, "http_method": %HM, "request_id": %ID, "status": %ST, "frontend_name": %f, "retries": %rc, "server_name": %s, "server_ip": %si, "server_port": %sp, "backend_name": %b, "backend_queue": %bq, "backend_concurrent_connections": %bc, "client_ip": %ci, "client_port": %cp, "frontend_concurrent_connections": %fc, "message": %r, "server_concurrent_connections": %sc, "server_queue": %sq, "ssl_ciphers": %sslc, "ssl_version": %sslv, "response_time": %Td, "session_duration": %Tt}'

frontend http-in
  bind *:80
  bind :::80

  http-request redirect scheme https

syslog.conf

source s_loopback { syslog(ip(127.0.0.1) port(514) transport("udp")); };

block parser mixed-json-parser() {
  channel {
    junction {
      channel {
        parser { json-parser(prefix(".SDATA.haproxy@32473.")); };
        rewrite {
          set("${[email protected]}", value("MESSAGE"));
          unset(value("[email protected]"));
        };
        flags(final);
      };
      channel {
        flags(final);
      };
    };
  };
};

log {
  source(s_loopback);
  parser { mixed-json-parser(); };
  destination(d_bastion);
};