Took me a while to figure it out myself, but looks like the answer is by modifying the log format and rsyslog settings, because haproxy doesn't provide any "access logs" level.
Here is an example of what I did:
global log 127.0.0.1:514 len 65535 local0 info chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners stats timeout 30s user haproxy group haproxy daemon defaults log global mode http frontend http-in bind *:443 ssl crt /usr/local/ssl/haproxy.pem default_backend response-ok option http-buffer-request declare capture request len 2000000000 http-request capture req.body id 0 log-format "[http-request]: %ci,%[capture.req.hdr(0)]" backend response-ok errorfile 503 /etc/haproxy/errors/200.http
Now the next step is to change rsyslog to write all logs that starts with "[http-request]" to a different file, so I edited /etc/rsyslog.d/49-haproxy.conf like that:
# Collect log with UDP $ModLoad imudp $UDPServerAddress 127.0.0.1 $UDPServerRun 514 # We add :2: to remove leading whitespace $template access_logs_form, "%msg:2:$:%\n" # Send HAProxy access logs :msg, contains, "[http-request]:" { /var/log/haproxy/haproxy-traffic.log;access_logs_form stop } # Send HAProxy messages to a dedicated logfile :programname, startswith, "haproxy" { /var/log/haproxy/haproxy.log stop }
