haproxy -> fluentd forwarder -> fluentd server -> elasticsearch -> kibana

fluentd_forwarder.conf

<source>
  type tail
  path /var/log/haproxy.log
  pos_file /var/log/td-agent/haproxy.log.pos
  tag haproxy.http
  format /^(?<syslog_time>.+) (?<source_ip>.+) (?<ps>\w+)\[(?<pid>\d+)\]: (?<c_ip>[\w\.]+):(?<c_port>\d+) \[(?<time>.+)\] (?<f_end>[\w\.-]+) (?<b_end>[\w\.-]+)\/(?<b_server>[^ ]+) (?<tq>[-]?\d+)\/(?<tw>[-]?\d+)\/(?<tc>[-]?\d+)\/(?<tr>[-]?\d+)\/(?<tt>\d+) (?<status_code>\d+) (?<bytes_read>\d+) (?<captured_request_cookie>.+) (?<captured_response_cookie>.+) (?<termination_state>.+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srv_conn>\d+)\/(?<retries>\d+) (?<srv_queue>\d+)\/(?<backend_queue>\d+) \"(?<http_request>.+)\"$/
  time_format %d/%b/%Y:%H:%M:%S.%L
</source>

<match *.**>
  type secure_forward
  shared_key ...
  self_hostname ...
  secure no
  <server>
    host ...
  </server>
</match>

fluentd_server_store_es.conf

# Input
<source>
  @type secure_forward
  shared_key ...
  self_hostname ...
  port 24284
  secure no
</source>

# Output
<match *.**>
  type copy
  <store>
    type elasticsearch
    host localhost
    port 9200
    include_tag_key true
    tag_key log_name
    logstash_format true
    flush_interval 1s
  </store>
</match>

haproxy.conf

global
	daemon
  maxconn 20480
	log /dev/log local0
  log /dev/log local1 notice
	chroot /var/lib/haproxy

defaults
	log global

rsyslog-haproxy.conf

$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514

# haproxy
local0.* /var/log/haproxy.log
&stop
local1.* /var/log/haproxy1.log
&stop


$AddUnixListenSocket /var/lib/haproxy/dev/log

# Send HAProxy messages to a dedicated logfile
if $programname startswith 'haproxy' then /var/log/haproxy.log
&~