update regex to handle {} brackets before http request info

[jsirianni]

Somehow our testing missed some brackets in the http default log format. This PR handles the brackets without deriving a new field from them. I have some concerns:

• The haproxy http log format doc suggest that we should see two fields near the end surrounded by curly braces, however our example logs only contain one set of braces

Sep 28 11:57:54 oiq-int-haproxy haproxy[302161]: 10.66.8.2:53471 [28/Sep/2021:11:57:54.672] http-json apache/apache 0/0/0/0/0 200 11173 - - ---- 1/1/0/0/0 0/0 {10.33.104.161:8082|} "GET / HTTP/1.1"

• our braces seem to contain a host:port combination while the doc suggest we should see some headers here.

I think for now, we should handle the braces without adding the contents as a new field.

config:

pipeline:
- type: haproxy
  file_log_path:
  - ./in
  start_at: beginning
- type: stdout

new test input: (containers: {oiq-int-haproxy:8082|}

Sep 28 11:38:26 oiq-int-haproxy haproxy[302161]: 10.66.8.2:53241 [28/Sep/2021:11:38:26.670] http-json apache/apache 0/0/0/0/0 200 11161 - - ---- 1/1/0/0/0 0/0 {oiq-int-haproxy:8082|} "GET / HTTP/1.1"

previous test input: (no curly braces before GET)

Sep 19 15:49:00 oiq-int-haproxy haproxy[15165]: 127.0.0.1:40140 [16/Sep/2021:16:32:49.352] http http/<NOSRV> -1/-1/-1/-1/0 503 213 - - SC-- 1/1/0/0/0 0/0 "GET / HTTP/1.1"

output:

{
  "timestamp": "2021-09-28T11:38:26-04:00",
  "severity": 30,
  "severity_text": "200",
  "labels": {
    "file_name": "in",
    "log_type": "haproxy",
    "method": "GET",
    "plugin_id": "haproxy",
    "protocol": "HTTP",
    "protocol_version": "1.1"
  },
  "resource": {
    "backend_name": "apache",
    "frontend_ip": "10.66.8.2",
    "frontend_port": "53241",
    "frontend_type": "http",
    "host": "oiq-int-haproxy",
    "server_name": "apache"
  },
  "record": {
    "accept_date": "28/Sep/2021:11:38:26.670",
    "backend_concurrent_connections": "0",
    "backend_queue": "0",
    "bytes_read": "11161",
    "captured_request_cookie": "-",
    "captured_response_cookie": "-",
    "client_request_active_time": "0",
    "client_request_send_time": "0",
    "frontend_concurrent_connections": "1",
    "frontend_name_transport": "http-json",
    "path": "/",
    "pid": "302161",
    "process_concurrent_connections": "1",
    "process_name": "haproxy",
    "queue_wait_time": "0",
    "response_send_time": "0",
    "response_time": "0",
    "retries": "0",
    "server_concurrent_connections": "0",
    "server_queue": "0",
    "status": "200",
    "termination_state": "----"
  }
}

https://regex101.com/r/ChyY26/1

[Dylan-M]

Suggested change inline, it isn't a named group, so shouldn't add anything to the output if I understand correctly.