HAProxy with Fluent Bit

project-root/
├── docker-compose.yml
├── fluent-bit/
│   ├── fluent-bit.conf
│   ├── parsers.conf
│   └── send_to_onefirewall.lua
├── haproxy/
│   └── haproxy.cfg

global
  log fluent-bit:5140 local0
  daemon

defaults
  log global
  mode http
  option httplog
  timeout connect 5s
  timeout client  30s
  timeout server  30s

[PARSER]
    Name        haproxy_raw
    Format      regex
    Regex       ^<\d+>\w+\s+\d+\s+\d+:\d+:\d+\s+haproxy\[\d+\]: (?<src_ip>\d+\.\d+\.\d+\.\d+):\d+ \[[^\]]+\] \S+ \S+ \d+/\d+/\d+/\d+/\d+ (?<action>\d{3})

function escape(s)
    s = string.gsub(s, '\\', '\\\\')
    s = string.gsub(s, '"', '\\"')
    return s
end

function cb_send(tag, ts, record)
    local src_ip = tostring(record["src_ip"])
    local action = tostring(record["action"])

    if not string.match(src_ip, "^%d+%.%d+%.%d+%.%d+$") then
        return -1
    end

    local json = string.format(
        '{"src_ip":"%s","dst_ip":"192.168.0.1","src_port":3435,"dst_port":443,"service":"myservice","firewall":"haproxy","action":"%s","direction":"inbound"}',
        escape(src_ip),
        escape(action)
    )

    return 1, ts, {
        body = json,
        headers = {}
    }
end

[SERVICE]
    Flush        1
    Log_Level    info
    Parsers_File /fluent-bit/etc/parsers.conf

[INPUT]
    Name        syslog
    Mode        udp
    Listen      0.0.0.0
    Port        5140
    Parser      haproxy_raw
    Tag         haproxy.syslog

[FILTER]
    Name    lua
    Match   haproxy.*
    script  /fluent-bit/etc/send_to_onefirewall.lua
    call    cb_send

[OUTPUT]
    Name        http
    Match       haproxy.*
    Host        app.onefirewall.com
    Port        443
    URI         /api/v1/poc_traffic/direct
    Format      msgpack
    tls         On
    tls.verify  On
    Header      Authorization Bearer YOUR_TOKEN_HERE
    Header      Content-Type application/json
    Body_Key    body
    Headers_Key headers
    Compress    off

[OUTPUT]
    Name   stdout
    Match  *
    Format json_lines

version: '3.8'
services:

  haproxy:
    image: haproxy:lts-alpine3.21
    container_name: haproxy
    ports:
      - "443:443"
    depends_on:
      - fluent-bit
    command: >
      sh -c "haproxy -f /usr/local/etc/haproxy/haproxy.cfg"
    volumes:
      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg

  fluent-bit:
    image: fluent/fluent-bit:2.1
    container_name: fluent-bit
    ports:
      - "5140:5140/udp"
    volumes:
      - ./fluent-bit:/fluent-bit/etc