# How to match haproxy http code with crowdsec rules

**URL:** <https://discourse.crowdsec.net/t/how-to-match-haproxy-http-code-with-crowdsec-rules/1167>\
**Category:** crowdsec\
**Created:** [February 16, 2023, 8:28pm UTC](https://discourse.crowdsec.net/t/how-to-match-haproxy-http-code-with-crowdsec-rules/1167 "2023-02-16T20:28:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ehsanhajian](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/ehsanhajian/32/543_2.png) [@ehsanhajian](https://discourse.crowdsec.net/u/ehsanhajian)\
**Post date:** [February 16, 2023, 8:28pm UTC](https://discourse.crowdsec.net/t/how-to-match-haproxy-http-code-with-crowdsec-rules/1167/1 "2023-02-16T20:28:17Z")

</div>

Hi guys. I’m new with crowsec sorry for noob question. I have ratelimit in haproxy and IPs that are matched with it, will get erro 429. Now I want to block those IPs. I mean if someone get 429 and if he insist to send requests it get block by crowdsec. thank you in advance for your reply.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [February 20, 2023, 9:34am UTC](https://discourse.crowdsec.net/t/how-to-match-haproxy-http-code-with-crowdsec-rules/1167/2 "2023-02-20T09:34:35Z")

</div>

You could create a scenario like this

```yaml
type: leaky
name: ehsanhajian/haproxy-rate-limit
description: "Detect rate limit abuse"
filter: evt.Meta.http_status == '429'
groupby: "evt.Meta.source_ip"
capacity: 5
leakspeed: 30s
blackhole: 5m
labels:
  service: http
  remediation: true

```