HAProxy logsatsh grok rule for TLSv1 heartbeat attack
@@ -54,7 +54,7 @@ filter {
}
# Sometimes HAproxy will report an SSL handshake failure, using a different log line. We check for that as well
- if "SSL handshake failure" in [message] {
+ if "SSL handshake failure" in [message] or "TLSv1 heartbeat attack" in [message] {
grok {
match => { "messagenosyslog" => [ "%{IPORHOST:[source][ip]}:%{POSINT:[source][port]} \[(?<[redir][timestamp]>%{MONTHDAY}\/%{MONTH}\/%{YEAR}:%{TIME})\] (?<[redir][frontend][name]>([^/]*))%{GREEDYDATA:[http][request][body][content]}" ] }
}
