diff --git a/roles/filebeat/templates/filebeat.yml.j2 b/roles/filebeat/templates/filebeat.yml.j2
index 3abc622e8a5a977305af304cd5c4ba108b0a01f2..3335c48b7d3d00b1b9ff8733ed22007be776594d 100644
--- a/roles/filebeat/templates/filebeat.yml.j2
+++ b/roles/filebeat/templates/filebeat.yml.j2
@@ -1,9 +1,15 @@
 filebeat.inputs:
+{% if FILEBEAT_FILES is defined %}
 - type: log
   paths:
 {% for file in FILEBEAT_FILES %}
       - {{ file }}
 {% endfor %}
+{% else %}
+- type: syslog
+  protocol.udp:
+    host: "localhost:{{ FILEBEAT_SYSLOG_PORT }}"
+{% endif %}
   fields:
     log_type: {{ FILEBEAT_LOG_TYPE }}
 
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2
index ad7771013a8df7e0232be23466d34ea74f70f0ce..72901471979a0ac2ef350bfe4644d7dd8e80cd14 100644
--- a/roles/haproxy/templates/haproxy.cfg.j2
+++ b/roles/haproxy/templates/haproxy.cfg.j2
@@ -1,6 +1,6 @@
 global
   #quiet
-  log stdout format raw local0
+  log 127.0.0.1:9000  local0
   nbproc {{ HAPROXY_PROCESSES }}
   ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
   ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
diff --git a/soctools-inventory b/soctools-inventory
index 1ad3a1cb00abe5637c943d1b0e9235aced50156d..7a4e4f99ca639176eb7142463dae1cf7d6ed9352 100644
--- a/soctools-inventory
+++ b/soctools-inventory
@@ -35,5 +35,5 @@ dsoclab-nifi-3 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-curren
 #dsoclab-keycloak ansible_connection=docker FILEBEAT_FILES='[""]'
 #dsoclab-mysql ansible_connection=docker FILEBEAT_FILES='[""]'
 #dsoclab-misp ansible_connection=docker FILEBEAT_FILES='[""]'
-#dsoclab-haproxy ansible_connection=docker FILEBEAT_FILES='[""]'
+dsoclab-haproxy ansible_connection=docker FILEBEAT_SYSLOG_PORT=9000 FILEBEAT_LOG_TYPE="haproxy"
 #dsoclab-zookeeper ansible_connection=docker FILEBEAT_FILES='[""]'