HAProxy with Fluent Bit

This guide shows you how to capture logs from an HAProxy Docker container, extract relevant fields, and forward them to OneFirewall’s traffic validation API using Fluent Bit and Lua scripting.

Overview

HAProxy logs are sent directly to Fluent Bit over UDP (syslog)
Fluent Bit extracts fields (like source IP and HTTP status)
Lua script transforms log into a JSON payload
Fluent Bit posts the data to OneFirewall’s API

1. Folder Structure

project-root/
├── docker-compose.yml
├── fluent-bit/
│   ├── fluent-bit.conf
│   ├── parsers.conf
│   └── send_to_onefirewall.lua
├── haproxy/
│   └── haproxy.cfg

2. HAProxy Configuration

`haproxy.cfg`

global
  log fluent-bit:5140 local0
  daemon

defaults
  log global
  mode http
  option httplog
  timeout connect 5s
  timeout client  30s
  timeout server  30s

This configuration sends logs over UDP to Fluent Bit, which must be running in the same Docker network.

3. Fluent Bit Parser

`parsers.conf`

[PARSER]
    Name        haproxy_raw
    Format      regex
    Regex       ^<\d+>\w+\s+\d+\s+\d+:\d+:\d+\s+haproxy\[\d+\]: (?<src_ip>\d+\.\d+\.\d+\.\d+):\d+ \[[^\]]+\] \S+ \S+ \d+/\d+/\d+/\d+/\d+ (?<action>\d{3})

4. Lua Script for Transformation

`send_to_onefirewall.lua`

function escape(s)
    s = string.gsub(s, '\\', '\\\\')
    s = string.gsub(s, '"', '\\"')
    return s
end

function cb_send(tag, ts, record)
    local src_ip = tostring(record["src_ip"])
    local action = tostring(record["action"])

    if not string.match(src_ip, "^%d+%.%d+%.%d+%.%d+$") then
        return -1
    end

    local json = string.format(
        '{"src_ip":"%s","dst_ip":"192.168.0.1","src_port":3435,"dst_port":443,"service":"myservice","firewall":"haproxy","action":"%s","direction":"inbound"}',
        escape(src_ip),
        escape(action)
    )

    return 1, ts, {
        body = json,
        headers = {}
    }
end

5. Fluent Bit Configuration

`fluent-bit.conf`

[SERVICE]
    Flush        1
    Log_Level    info
    Parsers_File /fluent-bit/etc/parsers.conf

[INPUT]
    Name        syslog
    Mode        udp
    Listen      0.0.0.0
    Port        5140
    Parser      haproxy_raw
    Tag         haproxy.syslog

[FILTER]
    Name    lua
    Match   haproxy.*
    script  /fluent-bit/etc/send_to_onefirewall.lua
    call    cb_send

[OUTPUT]
    Name        http
    Match       haproxy.*
    Host        app.onefirewall.com
    Port        443
    URI         /api/v1/poc_traffic/direct
    Format      msgpack
    tls         On
    tls.verify  On
    Header      Authorization Bearer YOUR_TOKEN_HERE
    Header      Content-Type application/json
    Body_Key    body
    Headers_Key headers
    Compress    off

[OUTPUT]
    Name   stdout
    Match  *
    Format json_lines

6. Docker Compose Example

version: '3.8'
services:

  haproxy:
    image: haproxy:lts-alpine3.21
    container_name: haproxy
    ports:
      - "443:443"
    depends_on:
      - fluent-bit
    command: >
      sh -c "haproxy -f /usr/local/etc/haproxy/haproxy.cfg"
    volumes:
      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg

  fluent-bit:
    image: fluent/fluent-bit:2.1
    container_name: fluent-bit
    ports:
      - "5140:5140/udp"
    volumes:
      - ./fluent-bit:/fluent-bit/etc

Ensure both containers are on the same network (Docker Compose does this by default).

7. OneFirewall Traffic Validation

When Fluent Bit sends structured traffic data to OneFirewall:

OneFirewall validates src_ip and dst_ip fields

Invalid or private IPs are rejected with:

{ "message": "Not valid SRC or DST IP" }

Ensure you’re using valid public IPv4 addresses for testing.

Result

With this setup in place, HAProxy logs flow to Fluent Bit over UDP, get parsed and transformed into JSON by the Lua script, and are posted directly to OneFirewall’s traffic validation API.

Notes

Replace YOUR_TOKEN_HERE with your actual OneFirewall token
Consider adding retry/failure handling or S3 backup for production
Ensure dst_ip is not a private/local IP unless OneFirewall allows it

Need Help?

Reach out to OneFirewall Support if you need help debugging HTTP integration or validating traffic.

Get Started

Essentials

Releases

Case Studies

WCF Agent

Products

Updates

Overview

1. Folder Structure

2. HAProxy Configuration

`haproxy.cfg`

3. Fluent Bit Parser

`parsers.conf`

4. Lua Script for Transformation

`send_to_onefirewall.lua`

5. Fluent Bit Configuration

`fluent-bit.conf`

6. Docker Compose Example

7. OneFirewall Traffic Validation

Result

Notes

Need Help?

​Overview

​1. Folder Structure

​2. HAProxy Configuration

​haproxy.cfg

​3. Fluent Bit Parser

​parsers.conf

​4. Lua Script for Transformation

​send_to_onefirewall.lua

​5. Fluent Bit Configuration

​fluent-bit.conf

​6. Docker Compose Example

​7. OneFirewall Traffic Validation

​Result

​Notes

​Need Help?

Overview

1. Folder Structure

2. HAProxy Configuration

`haproxy.cfg`

3. Fluent Bit Parser

`parsers.conf`

4. Lua Script for Transformation

`send_to_onefirewall.lua`

5. Fluent Bit Configuration

`fluent-bit.conf`

6. Docker Compose Example

7. OneFirewall Traffic Validation

Result

Notes

Need Help?