3

I am capturing the user-agent using:

http-request capture req.hdr(User-Agent) len 192

And then trying to create a custom JSON log format like this:

log-format '{"User-Agent":%{+Q,+E}[capture.req.hdr(0)]}'

It works but when a User Agent includes square brackets, for example:

Dalvik/1.6.0 (Linux; U; Android 4.4.4; Ixion X LTE 4.5 [Build KTU84P])

The option +E escapes the square bracket and brakes the JSON, it creates something like:

"User-Agent": "Dalvik/1.6.0 (Linux; U; Android 4.4.4; Ixion X LTE 4.5 \[Build KTU84P])"

When the UA contains extra quotes there is no problem:

"User-Agent": "this \"works\" fine"

Therefore wondering if there is a way to specify escaping only double quotes or alternatives to make the log format JSON compatible

nbari
  • 548
  • 1
  • 8
  • 25

1 Answers1

2

Newer version of haproxy have a built-in json encoder, which you can use to define a JSON log format. See https://www.haproxy.org/download/2.1/doc/configuration.txt

json([<input-code>])
Escapes the input string and produces an ASCII output string ready to use as a JSON string. The converter tries to decode the input string according to the <input-code> parameter. It can be "ascii", "utf8", "utf8s", "utf8p" or "utf8ps". The "ascii" decoder never fails.
....
Example:

capture request header Host len 15
capture request header user-agent len 150
log-format '{"ip":"%[src]","user-agent":"%[capture.req.hdr(1),json(utf8s)]"}'

Input request from client 127.0.0.1:

GET / HTTP/1.0

User-Agent: Very "Ugly" UA 1/2

Output log:

{"ip":"127.0.0.1","user-agent":"Very \"Ugly\" UA 1\/2"}
HBruijn
  • 72,524
  • 21
  • 127
  • 192