Fluentd is unable to parse the regex. How can I debug the issue?
I verified the regex using https://fluentular.herokuapp.com/, it is verified and working.
fluentd configuration is as follows -
<source>
@id haproxy
@type syslog
port 5140
bind 0.0.0.0
tag haproxy
<parse>
@type multi_format
<pattern>
format regexp
expression /^\<(?<pri>[0-9]{1,3})\>(?<syslogTime>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? (?<remoteAddress>[-\w\.]+:\d+) \[(?<requestDate>[^\]]*)\] (?<frontend>[-\w]+) (?<namespace>[-\w]+)-(?<service>[-\w]+)-(?<serviceTargetPort>[\d]+)?\/[-\w]+ (?<requestReadTime>\d+)\/(?<waitTime>\d+)\/(?<backendConnectTime>\d+)\/(?<backendResponseTime>\d+)\/(?<responseTime>\d+) (?<statusCode>\d+) (?<responseBytes>\d+) (?<reqCookie>[-\w]+) (?<resCookie>[-\w]+) (?<terminationState>[-\w]+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srvconn>\d+)\/(?<retries>\d+) (?<srvqueue>\d+)\/(?<backendQueue>\d+) "(?<method>[A-Z]+) (?<url>[^ ]+) (?<httpVersion>[^ ]+)"$/
</pattern>
<pattern>
format regexp
expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Connect from (?<remoteAddress>[\w\.]+:\d+) to (?<backendAddress>[\w\.]+:\d+) \((?<frontend>[\w]+)\/(?<mode>[\w]+)\)$/
</pattern>
<pattern>
format regexp
expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Server (?<namespace>ops-system|[\w]+)-(?<service>[-\w]+)\/[-\w]+ is going DOWN for maintenance. (?<remainingActive>\d+) active and (? <remainingBackup>\d+) backup servers left. (?<activeSessions>\d+) sessions active, (?<requeued>\d+) requeued, (?<remainingInQueue>\d+) remaining in queue.$/
</pattern>
<pattern>
format regexp
expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Server (?<namespace>ops-system|[\w]+)-(?<service>[\w-]+)\/[\w-]+ is (?<status>[\w]+), reason: (?<reason>[^,]+), (info: "(?<info>[^"]+)", )? check duration: (?<checkDuration>[^.]+). (?<remainingActive>\d+) active and (?<remainingBackup>\d+) backup servers (left|online). ((?<activeSessions>\d+) sessions active, )?(?<requeued>\d+) (sessions )?requeued, (?<remainingInQueue>\d+) (remaining|total) in queue.$/
</pattern>
</parse>
</source>
The error I am getting is -
2019-11-04 17:03:42 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov 4 17:03:42 haproxy[116]: 172.27.0.0:16798 [04/Nov/2019:17:03:42.558] http default-app2-8080/SRV_sKdQm 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""
2019-11-04 17:06:07 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov 4 17:06:07 haproxy[116]: 172.27.0.0:17684 [04/Nov/2019:17:06:07.435] http default-app2-8080/SRV_nI2xB 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""
2019-11-04 17:06:08 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov 4 17:06:08 haproxy[116]: 172.27.0.0:17692 [04/Nov/2019:17:06:08.075] http default-app2-8080/SRV_sKdQm 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""