logstash.conf for HAProxy with custom captured request/response headers

gistfile1.txt

input {
	beats {
		port => 5044
	}

	tcp {
		port => 5000
	}
}

## Add your filters / logstash plugins configuration here
filter {
	grok {
		pattern_definitions => {
			"HOST" => "%{HOSTNAME}"
			"HAPROXYCAPTUREDREQUESTHEADERS" => "%{IP:connecting_ip}\|%{HOST:target_host}\|%{DATA:user_agent}"
			"HAPROXYCAPTUREDRESPONSEHEADERS" => "%{DATA:route_name}\|%{DATA:device_type}"
		}

		match => {
			"message" => "%{HAPROXYHTTP}"
		}
	}
	
	date {
		match => ["syslog_timestamp", "MMM dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "yyyy-MM-dd HH:mm:ss.SSS", "ISO8601"]
		target => "@timestamp"
		timezone => "Europe/Stockholm"
	}
}

output {
	elasticsearch {
		hosts => "..."
		user => "..."
		password => "..."
		ecs_compatibility => disabled
	}
}