Haproxy logstash to StatsD

Haproxy logstash to StatsD

input {
  tcp {
    port => 5140
    type => "haproxy"
  }
}

filter {
  grok {
    # break the input "message" into two parts: a priority structure,
    # and everything else, the haproxy_message
    match => ["message", "<%{POSINT:syslog_pri}>%{GREEDYDATA:haproxy_message}"]
    named_captures_only => true
  }
  grok {
    # use a well-known pattern to break up haproxy_message
    match               => ["haproxy_message", "%{HAPROXYHTTP}"]
    keep_empty_captures => true
  }
  mutate {
    # our stat-names have dots in them, so change any dots in the server name dashes, and remove angles
    gsub => ["server_name", "\.", "_"]
    gsub => ["server_name", "[<>]", ""]
    lowercase => ["server_name"]
  }
  if [http_status_code] == "-1" {
    # -1 is not valid for the stat-name.
    mutate {
      update => ["http_status_code", "nil"]
    }
  }
  if [server_name] == "nosrv" {
    mutate {
      update => ["backend_name", "nobe"]
    }
  }
}

output {
  #stdout { codec => 'rubydebug' }

  if [type] == "haproxy" {
    statsd {
      host      => "${AGGREGATOR_HOST}"
      namespace => "haproxy"
      sender    => "haproxy-${AWS_REGION}"
      count => [
        "connections", "%{actconn}",
        "%{frontend_name}.connections", "%{feconn}",
        "%{frontend_name}.%{backend_name}.queue", "%{backend_queue}",
        "%{frontend_name}.%{backend_name}.connections", "%{beconn}",
        "%{frontend_name}.%{backend_name}.%{server_name}.retries", "%{retries}",
        "%{frontend_name}.%{backend_name}.%{server_name}.queue", "%{srv_queue}",
        "%{frontend_name}.%{backend_name}.%{server_name}.connections", "%{srvconn}",
        "%{frontend_name}.%{backend_name}.%{server_name}.response_size", "%{bytes_read}"
      ]
      increment => [
        "%{frontend_name}.%{backend_name}.%{server_name}.hits",
        "%{frontend_name}.%{backend_name}.%{server_name}.responses.%{http_status_code}"
      ]
      timing => [
        "%{frontend_name}.%{backend_name}.connect_time", "%{time_backend_connect}",
        "%{frontend_name}.%{backend_name}.response_time", "%{time_backend_response}",
        "%{frontend_name}.%{backend_name}.%{server_name}.response_time", "%{time_duration}",
        "%{frontend_name}.%{backend_name}.%{server_name}.request_time", "%{time_request}",
        "%{frontend_name}.%{backend_name}.%{server_name}.queue_time", "%{time_queue}"
      ]
    }
  }
}