cat /var/log/haproxy.log | halog -u -H -q | awk 'NR==1; NR > 1 {print $0 | "sort -n -r -k 1"}' | column -t
#req  err  ttot  tavg  oktot  okavg  bavg  btot  src

cat /etc/rsyslog.d/49-haproxy.conf 
# Create an additional socket in haproxy's chroot in order to allow logging via
# /dev/log to chroot'ed HAProxy processes
$AddUnixListenSocket /var/lib/haproxy/dev/log

# Send HAProxy messages to a dedicated logfile
if $programname startswith 'haproxy' then /var/log/haproxy.log
&~

cat /etc/haproxy/haproxy.cfg

global
  maxconn 100000
  user haproxy
  group haproxy
  stats socket /run/haproxy/haproxy1.sock mode 660 level admin process 1
  stats socket /run/haproxy/haproxy2.sock mode 660 level admin process 2
  nbproc 2
  cpu-map 1 0
  cpu-map 2 1
  log /dev/log local0
  log /dev/log local1 notice
  tune.maxrewrite  16384
  tune.bufsize     32768

defaults
  log global
  mode http
  option dontlognull
  option httplog
  option http-keep-alive
  option forwardfor
  option http-buffer-request
  retries 3
  option redispatch
  timeout http-request 30s
  timeout queue 1m
  timeout connect 10s
  timeout client 30s
  timeout server 30s
  timeout http-keep-alive 31s
  timeout check 10s
  maxconn 300000

frontend main
  bind *:80
  bind *:443 ssl crt /etc/haproxy/certs/ no-sslv3
  log-format "%ci:%cp [%tr] %HM %ST %HU body:%[capture.req.hdr(0)]"
  mode http
  option http-keep-alive
  stats enable
  stats uri /haproxy?vid
  stats realm Strictly\ Private
  stats auth xxxxxxxx:XXXXXXXXXXXXXXXXX
  declare capture request len 40000
  http-request add-header X-Forwarded-Proto https if { ssl_fc }
  http-request capture req.body id 0
  http-response set-log-level err if { status 400:499 }
  acl  is_test  dst_port      80
  acl  is_test  dst_port      443
  use_backend     test    if  is_test
  default_backend   test

backend test
  mode http
  option forwardfor
  option httpchk HEAD /xxx/xxxxxxx
  http-check expect status 200
  http-request add-header X-Forwarded-For %[src]
  http-request add-header X-Real-Ip %[src]
  balance roundrobin
  maxconn 300000
  server xxxxxxxxxxxxxxxxxxx xx.xxx.xxx.xxx:xx maxconn 100000 check inter 5000

tail -f /var/log/haproxy.log | awk '{ print $9 }' | grep -v 200