Extracting HAProxy JSON logs inside syslog/journald

[olivermussell]

Question

We're generating JSON formatted logs from HAProxy which will send to syslog / journald and are then collected by Vector. I'm trying to build a Vector configuration which can extract the fields from the JSON formatted log line and having difficulty.

The config so far will successfully parse the syslog and remove the syslog parts, leaving only the JSON log as a string inside a message object. But I cant figure out how to then parse that string as JSON. The final output should be only the HTTP request, status code and method.

Vector Config

sources:
  haproxy_logs:
    type: journald
    include_units:
      - haproxy
transforms:
  extract_haproxy:
    type: remap
    inputs:
      - haproxy_logs
      source: |
        . = parse_syslog!(.message)
        del(.appname)
        del(.facility)
        del(.hostname)
        del(.msgid)
        del(.procid)
        del(.severity)
        del(.version)

        .http_request = .request.uri
        .http_status_code = .response.status_code
        .http_verb = .request.method

Vector Logs

Jan 22 15:13:51 server-01 haproxy[43002]: {host:server-01,time:22/Jan/2026:15:13:51 +0000,haproxy:{conn:{act:2,fe:1,be:0,srv:0},queue:{backend:0,srv:0},time:{tq:0,tw:-1,tc:-1,tr:-1,tt:0},termination_state:LR--,retries:0,network:{client_ip:10.0.0.1,client_port:50034,frontend_ip:10.0.0.2,frontend_port:8005},ssl:{version:-,ciphers:-},request:{method:GET,uri:\/heartbeat\/,protocol:HTTP/1.1,header:{user_agent:ELB-HealthChecker\/2.0,x_forwarded_for:-}},name:{backend:backend1,frontend:frontend1,server:<NOSRV>},response:{status_code:200,header:{},bytes:{uploaded:131,read:73}},txn:{identity:-,identity_by:-}}}

[thomasqueirozb]

This output is not really json and there is no function we provide that would support this natively. The good news is that you can configure HAProxy 3.0+ to output actual json by using the %{+json}o prefix in log-format. Look for +json in this article https://www.haproxy.com/blog/encoding-haproxy-logs-in-machine-readable-json-or-cbor. You should be able to use parse_json after this is properly configured

[olivermussell]

We had configured haproxy to output as json but didnt include single quotes around the log-format setting so it output invalid json without double quotes when it was passed to vector. I assumed I was just doing the vector config wrong, thanks for your help!