# CONFIGURED BY ANSIBLE

# remove syslog kind of prefix
#[PARSER]
#    name haproxy_log
#    format regex
#    regex ^[^ ]+ [^ ]+ [^ ]+ [^ ]+ [^ ]+: (?<message>.*)

# [NOTICE]   (79703) : Loading success.","sensor":"haproxy@haproxy-zone-b
#[PARSER]
#    name haproxy_message_only
#    format regex
#    regex ^\[(?<haproxy_level>[^ ]*)\] +[^ ]* *: (?<haproxy_log>.*)

# split-up the request field
[PARSER]
    name split_request
    format regex
    regex ^(?<method>[^ ]*) (?<path>[^ ]*) HTTP/(?<http_version>[^ ]*)

# help differenciate web pages - strip out the query string
[PARSER]
    name strip_querystr
    format regex
    regex ^(?<page>[^?]*)

# obfuscate only the secret part
# catch token= password= search_field=code&search_value= code= and avoid barcode=
[PARSER]
    name obfus_secrets
    format regex
    regex ^(?<path_first>.+(token|password|search_field=code&search_value|[?&]code)=)[^&]+(?<path_second>.*)