Anyone using HSL with Graylog

Hi,

Thank you for the example of GRAYLOG Json format.

I just configured request logging instead of irule with HSL with following parameters:

ltm profile request-log logging-GRAYLOG {
    app-service none
    defaults-from request-log
    response-log-pool POOL-GRAYLOG
    response-log-protocol mds-tcp
    response-log-template "{\"version\": \"1.1\", \"host\":\"$Host\", \"short_message\":\"$HTTP_REQUEST\", \"level\":6, \"facility\":\"F5_access_log\",  \"timestamp\": \"$TIME_UNIX\", \"_httpStatus\":\"$HTTP_STATUS\",  \"_userAgent\":\"${user-Agent}\", \"_clientIp\":\"$CLIENT_IP\", \"_user\":\"$User\", \"_respBytes\":\"$RESPONSE_SIZE\", \"_elapsed\":\"$RESPONSE_MSECS\"}"
    response-logging enabled
}

The log template is the following:

{"version": "1.1", "host":"$Host", "short_message":"$HTTP_REQUEST", "level":6, "facility":"F5_access_log",  "timestamp": "$TIME_UNIX", "_httpStatus":"$HTTP_STATUS",  "_userAgent":"${user-Agent}", "_clientIp":"$CLIENT_IP", "_user":"$User", "_respBytes":"$RESPONSE_SIZE", "_elapsed":"$RESPONSE_MSECS"}

User value is from following irule:

when CLIENT_ACCEPTED {
    set APMusername ""
}

when ACCESS_ACL_ALLOWED {
    if {$APMusername equals ""} {
        set APMusername [ACCESS::session data get session.logon.last.username]
    }
    HTTP::header insert "USER" $APMusername
}

when HTTP_REQUEST_RELEASE {
    catch {HTTP::header remove "USER"}
}

with this log template, I was able to parse JSON content and filter requests by key value.