A specific HAProxy HTTP Pattern is not being matched

[raghukumarc]

Hello,

This particular request on my HAProxy server is being tagged with ["_grokparsefailure"]. I am pasting the log event below. I have tried using the grok debugger and it says - "No matches"

May 26 03:51:23 localhost haproxy[13489]: 199.16.156.124:17410 [26/May/2015:03:51:23.433] http-in web-cluster/web-4 0/0/0/13/13 200 14631 - - --NR 0/0/0/0/0 0/0 {} {} "GET /tivamoservice/mo/275-Josh-Herbert-Live-Performance-and-Q&A HTTP/1.1"

My gut feeling says that the '&' character as part of the URIPATHPARAM is the reason for the pattern to fail.

It would be great if you could take a look at this.

Thank you,
Raghu

[danfinn]

I'm seeing this as well and I've been able to verify it using the grok debugger. It also appears to be because of ampersands for me as well. Here's an example of one that caused a GPF:

Oct 28 21:39:06 localhost haproxy[36148]: 10.110.7.49:52385 [28/Oct/2015:21:39:06.382] PS benefits/ps-prod-app19 0/0/0/42/42 404 1354 - - ---- 2/2/1/0/0 0/0 {benefits.ps.||https://benefits.ps} {Apache/2.4.12 (Unix)||no-cache||} "GET /up/&benefit_subscriber_id=337015810z90571d2f3446e38a3929574e95aeda51c3ce37c740c740629f4899b074237d58 HTTP/1.0"

[elyscape]

That is indeed the issue. URIPATH doesn't match ampersands. RFC1738 specifies that URL paths can legally contain ampersands:

; HTTP

httpurl        = "http://" hostport [ "/" hpath [ "?" search ]]
hpath          = hsegment *[ "/" hsegment ]
hsegment       = *[ uchar | ";" | ":" | "@" | "&" | "=" ]
search         = *[ uchar | ";" | ":" | "@" | "&" | "=" ]

[ashemedai]

Isn't this ticket solved by the above commit and can thus be closed?

[elyscape]

Yes, this issue should be fixed now.