message: better handle special haproxy cases
diff: @@ -17,18 +17,23 @@ filter {
  grok {
  match => ["message", "(?:%{SYSLOGTIMESTAMP:syslog_timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) %{SYSLOGPROG}: %{HAPROXYHTTPBASE}"]
  }
  + # If the above grok has an error and it contains "be_sni/fe_sni" inside the message, this Hit is an internal haproxy forward for HTTPs SNI requests
  + # we can savely drop them as they don't contain any information and will be logged twice anyway
  + if "_grokparsefailure" in [tags] and [message] =~ /be_sni\/fe_sni/ {
  + drop { }
  + }
  grok {
  match => ["captured_request_headers", "%{URIHOST:request_header_host}\|%{GREEDYDATA:request_header_useragent}"]
  }
  grok {
  - match => ["backend_name", "%{NOTSPACE:haproxy_backend}:%{NOTSPACE:openshift_project}:%{NOTSPACE:openshift_route}"]
  + match => {"backend_name" => [ "%{NOTSPACE:haproxy_backend}:%{NOTSPACE:openshift_project}:%{NOTSPACE:openshift_route}", "%{NOTSPACE:openshift_project}" ] }
  }
  grok {
  - match => ["server_name", "pod:%{NOTSPACE:openshift_pod}:%{NOTSPACE:openshift_service}:%{NOTSPACE:openshift_pod_ip}:%{NOTSPACE:openshift_pod_port}"]
  + match => {"server_name" => [ "pod:%{NOTSPACE:openshift_pod}:%{NOTSPACE:openshift_service}:%{NOTSPACE:openshift_pod_ip}:%{NOTSPACE:openshift_pod_port}", "%{NOTSPACE:server_name}" ] }
  }
  if ![openshift_project] {
  mutate {
  - add_field => { "openshift_project" => "noproject" }
  + add_field => { "openshift_project" => "errors" }
  }
  }
  # We run automated testing which creates project names in the form of e2e-0000000000-AAAAAAAAAAAAAAAAAAAAAAAAAA
  