Skip to content




Managing traffic on your servers is an important skill, and HAProxy is the ideal tool for the job. Load balancing increases reliability and performance while lowering user frustration. HAProxy is a simple, scalable, and effective way of load balancing among busy web servers.

The benefits of using a load balancer are realized once you’ve deployed multiple web servers. The load balancer can then relay traffic to each of them, allowing you to grow your capacity to serve more clients without asking those clients to connect to each server directly. HAProxy receives the traffic and then balances the load across your servers. This technique hedges against any one of your servers failing since the load balancer can detect if a server becomes unresponsive and automatically stop sending traffic to it. You can use HAProxy to balance the traffic to any number of web applications using a single configuration file.

Product Details

Vendor URL: HAPROXY Loadbalancer

Product Type: Load Balancer

Product Tier: Tier III

Integration URL: HAPROXY LoadBalancer - Cyderes Documentation

Log Guide: Sample Logs by Log Type

Parser Details

Log Format: Syslog

Expected Normalization Rate: 99-100%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
actconn additional.fields
beconn additional.fields
bytes_read network.received_bytes
client_ip principal.ip
client_port principal.port
feconn additional.fields
program observer.hostname
retries additional.fields
server_name network.tls.client.server_name
srvconn additional.fields
target_port target.port
target_ip target.ip
Tc additional.fields
termination_state additional.fields
ts metadata.event_timestamp
Tt additional.fields
Tw additional.fields

Product Event Types

Event UDM Event Classification

Log Sample

<134>Oct 18 23:59:43 haproxy[12345]: [18/Oct/2023:23:59:42.601] frontend_ssl backend_ssl/server_name 1/0/505 100745 PR 25/25/24/24/0 0/0

Sample Parsing

additional.fields[actconn] = "25"
additional.fields[beconn] = "24"
additional.fields[feconn] = "25"
additioanl.fields[retries] = "0"
additional.fields[srvconn] = "24"
additional.fields[Tc] = "0"
additional.fields[termination_state] = "PR"
additional.fields[Tt] = "505"
additional.fields[Tw] = "1"
metadata.event_timestamp = "Oct 18 23:59:43"
network.received_bytes = "100745"
network.tls.client.server_name = "server_name"
observer.hostname = "haproxy" = "12345"
principal.ip = ""
principal.port = "32000"[backend_name] = "backend_ssl"[frontend_name] = "frontend_ssl"


Coming Soon