Nenad, thank you so much for your help; I was able to run that successfully on a test instance, I think that may fix the majority of my issue!
Thanks again, Phillip On Mon, Jul 6, 2015 at 4:55 PM, Nenad Merdanovic <[email protected]> wrote: > Hello Phillip, > > First, let me apologize for misspelling your name the first time. > > On 7/6/2015 10:46 PM, Phillip Decker wrote: > > Hi Nenad, thanks for the reply! > > > > Okay, insofar as the first link - I can see where I can retrieve > > captures for use in acls or elsewhere, but is there a way to use these > > directly in the custom log format ( > > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#8.2.4 )? > > Being able to intersperse captures and the usual custom log format > > entries on the same log line is my main problem. > > > > Yes, I was excited to use the new declared captures, but it came down to > > the same question as above; is there a way to use a declared capture in > > a custom log format line? If I can, it solves my problems... > > > > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#8.2.4 > > As you can see here: > If a variable is named between square brackets ('[' .. ']') then it is > used as a sample expression rule (see section 7.3). This it useful to > add some less common information such as the client's SSL certificate's > DN, or to log the key that would be used to store an entry into a stick > table. > > So essentially what you have to do is add something like > %[capture.req.hdr(0)] to your log-format string. And then just change > the 0 to whatever capture you want depending on the capture ordering. > > Hope this helps. > > Nenda > > > In log.c I see that %hr is doing a for loop on the session's front end > > proxy struct's list of capture fields, but doesn't look like it can take > > any arguments or anything for declared captures. Looking through the > > diffs on that file back two years, I see a reference in April to moving > > the captures from http_txn to stream, but a look at the diffs show that > > doesn't change this issue. > > > > I'm looking through > > log.c <branch 1.6> : void parse_logformat_string(const char *fmt, struct > > proxy *curproxy, struct list *list_format, int options, int cap, const > > char *file, int line) > > for an indication of a way to define this, and I don't see it so far... > > am I missing it? > > > > Thanks again for any help! > > > > Phillip > > > > > > > > On Mon, Jul 6, 2015 at 4:10 PM, Nenad Merdanovic <[email protected] > > <mailto:[email protected]>> wrote: > > > > Hello Philip > > > > On 7/6/2015 9:47 PM, Phillip Decker wrote: > > > Hello again all, > > > > > > I have a configuration problem, and I have a workaround that I > don't > > > like, so I'm hoping someone here might have a better solution - > > > > > > I have a number of capture fields such as ssl_c_s_dn, request > header > > > referrer, request header X-Forwarded-For, etc that get logged > using %hr, > > > among another 12 or so fields such as %t, %H, %B, %ci and so on. > > > > > > The problem is the client has an established log format which goes > to an > > > enterprise centralized log db. I'd love to be able to write out > this > > > format directly with haproxy, but since all the captured fields in > > > haproxy get appended together by %hr and %hs, I don't know of a > way to > > > put one captured field in spot #4 of a log line, and then another > > > captured field in spot #7, etc. > > > > > > In order to work around this, I have haproxy instead outputting > all this > > > data to an "intermediate" log format, and then have another process > > > running which picks these up and rearranges them into the > arbitrary log > > > format that the enterprise accepts. > > > > Well, it seems like you are looking to reorder the captures, so take > a > > look at: > > > http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#7.3.6-capture.req.hdr > > > > You can use this in your log format to specify a different ordering > than > > the one how the captures are sorted in the config. > > > > In 1.6 you could also use: > > > http://cbonte.github.io/haproxy-dconv/configuration-1.6.html#declare%20capture > > > > Let me know if this helps. > > > > Regards, > > Nenad > > > > >
