Hello Phillip, First, let me apologize for misspelling your name the first time.
On 7/6/2015 10:46 PM, Phillip Decker wrote: > Hi Nenad, thanks for the reply! > > Okay, insofar as the first link - I can see where I can retrieve > captures for use in acls or elsewhere, but is there a way to use these > directly in the custom log format ( > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#8.2.4 )? > Being able to intersperse captures and the usual custom log format > entries on the same log line is my main problem. > > Yes, I was excited to use the new declared captures, but it came down to > the same question as above; is there a way to use a declared capture in > a custom log format line? If I can, it solves my problems... > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#8.2.4 As you can see here: If a variable is named between square brackets ('[' .. ']') then it is used as a sample expression rule (see section 7.3). This it useful to add some less common information such as the client's SSL certificate's DN, or to log the key that would be used to store an entry into a stick table. So essentially what you have to do is add something like %[capture.req.hdr(0)] to your log-format string. And then just change the 0 to whatever capture you want depending on the capture ordering. Hope this helps. Nenda > In log.c I see that %hr is doing a for loop on the session's front end > proxy struct's list of capture fields, but doesn't look like it can take > any arguments or anything for declared captures. Looking through the > diffs on that file back two years, I see a reference in April to moving > the captures from http_txn to stream, but a look at the diffs show that > doesn't change this issue. > > I'm looking through > log.c <branch 1.6> : void parse_logformat_string(const char *fmt, struct > proxy *curproxy, struct list *list_format, int options, int cap, const > char *file, int line) > for an indication of a way to define this, and I don't see it so far... > am I missing it? > > Thanks again for any help! > > Phillip > > > > On Mon, Jul 6, 2015 at 4:10 PM, Nenad Merdanovic <[email protected] > <mailto:[email protected]>> wrote: > > Hello Philip > > On 7/6/2015 9:47 PM, Phillip Decker wrote: > > Hello again all, > > > > I have a configuration problem, and I have a workaround that I don't > > like, so I'm hoping someone here might have a better solution - > > > > I have a number of capture fields such as ssl_c_s_dn, request header > > referrer, request header X-Forwarded-For, etc that get logged using %hr, > > among another 12 or so fields such as %t, %H, %B, %ci and so on. > > > > The problem is the client has an established log format which goes to an > > enterprise centralized log db. I'd love to be able to write out this > > format directly with haproxy, but since all the captured fields in > > haproxy get appended together by %hr and %hs, I don't know of a way to > > put one captured field in spot #4 of a log line, and then another > > captured field in spot #7, etc. > > > > In order to work around this, I have haproxy instead outputting all this > > data to an "intermediate" log format, and then have another process > > running which picks these up and rearranges them into the arbitrary log > > format that the enterprise accepts. > > Well, it seems like you are looking to reorder the captures, so take a > look at: > > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#7.3.6-capture.req.hdr > > You can use this in your log format to specify a different ordering than > the one how the captures are sorted in the config. > > In 1.6 you could also use: > > http://cbonte.github.io/haproxy-dconv/configuration-1.6.html#declare%20capture > > Let me know if this helps. > > Regards, > Nenad > >
