On 20.03.20 14:06, Илья Шипицин wrote:
I am familiar with custom formats.
what I mean is (sample from IIS log)

so I can query it like "select * from ... where sc-status=200"  without prior knowledge 
what field "sc-status" is (format might change from file to file)

also, I guess log exporters may take advantage from it.


#Software: Microsoft Internet Information Services 8.5
#Version: 1.0
#Date: 2017-06-26 13:09:21
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username 
c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status 
time-taken
2017-06-26 13:09:21 192.168.183.152 GET / - 808 - 10.33.41.142 - - 200 0 64 
11451
2017-06-26 13:09:21 192.168.183.152 GET / - 808 - 10.33.41.142 - - 200 0 0 2378
2017-06-26 13:11:23 192.168.183.152 GET /favicon2.iso - 808 - 10.33.41.142 
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 2 1
2017-06-26 13:11:23 192.168.183.152 GET /favicon.iso - 808 - 10.33.41.142 
Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 404 0 2 2

Ah okay, well as far as I know is this not implemented.

пт, 20 мар. 2020 г. в 17:54, Aleksandar Lazic <al-hapr...@none.at 
<mailto:al-hapr...@none.at>>:

    Hi.

    On 20.03.20 13:15, Илья Шипицин wrote:
     > Hello,
     >
     > there's Microsoft LogParser.
     > good thing about it, it likes self-consistent CSV logs (or TSV), when 
first line is fields.
     >
     > it helps to change log format on the fly (for example, in IIS), so IIS 
starts new log once format is changed.
     >
     > you can query such logs without prior knowledge of fields, because 
fields are in log.
     >
     > I did not find such possibility in haproxy. is it supported ?
     > or must yet to be done.

    You can create any custom log format which you want with `log-format` 
directive.

    https://cbonte.github.io/haproxy-dconv/2.1/configuration.html#8.2.4
    https://www.haproxy.com/blog/haproxy-log-customization/

    Do this answer your question?

     > Cheers,
     > Ilya Shipitcin

    Regards
    Aleks



Reply via email to