diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 8f14d413fd1f..878d44724b65 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -58,6 +58,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
   including `http.response.elapsed_time` (ECS). {pull}10188[10188], {pull}10274[10274]
 - Rename multiple fields to `http.response.body.bytes`, from modules "apache", "iis",
   "kibana", "nginx" and "traefik", including `http.response.content_length` (ECS). {pull}10188[10188]
+- Change type from haproxy.log fileset fields from text to keyword: response.captured_headers, request.captured_headers, `raw_request_line`, `mode`. {pull}10397[10397]
 - Change type of field backend_url and frontend_name in traefik.access metricset to type keyword. {pull}10401[10401]
 - Ingesting Elasticsearch audit logs is only supported with Elasticsearch 6.5.0 and above {pull}10352[10352]
 - Migrate Elasticsearch audit logs fields to ECS {pull}10352[10352]
diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
index 018e01e5f724..6e2229b6af82 100644
--- a/filebeat/docs/fields.asciidoc
+++ b/filebeat/docs/fields.asciidoc
@@ -4694,7 +4694,7 @@ Condition the session was in when the session ended.
 *`haproxy.mode`*::
 +
 --
-type: text
+type: keyword
 
 mode that the frontend is operating (TCP or HTTP)
 
@@ -4901,7 +4901,7 @@ Optional "name=value" entry indicating that the client had this cookie in the re
 *`haproxy.http.response.captured_headers`*::
 +
 --
-type: text
+type: keyword
 
 List of headers captured in the response due to the presence of the "capture response header" statement in the frontend.
 
@@ -4934,7 +4934,7 @@ Optional "name=value" entry indicating that the server has returned a cookie wit
 *`haproxy.http.request.captured_headers`*::
 +
 --
-type: text
+type: keyword
 
 List of headers captured in the request due to the presence of the "capture request header" statement in the frontend.
 
@@ -4944,7 +4944,7 @@ List of headers captured in the request due to the presence of the "capture requ
 *`haproxy.http.request.raw_request_line`*::
 +
 --
-type: text
+type: keyword
 
 Complete HTTP request line, including the method, request and HTTP version string.
 
diff --git a/filebeat/module/haproxy/_meta/fields.yml b/filebeat/module/haproxy/_meta/fields.yml
index 674d20f29be8..7f4f038393f1 100644
--- a/filebeat/module/haproxy/_meta/fields.yml
+++ b/filebeat/module/haproxy/_meta/fields.yml
@@ -60,7 +60,7 @@
           description: Condition the session was in when the session ended.
 
         - name: mode
-          type: text
+          type: keyword
           description: mode that the frontend is operating (TCP or HTTP)
 
         - name: connections
diff --git a/filebeat/module/haproxy/fields.go b/filebeat/module/haproxy/fields.go
index c541a242e12a..861f38444353 100644
--- a/filebeat/module/haproxy/fields.go
+++ b/filebeat/module/haproxy/fields.go
@@ -32,5 +32,5 @@ func init() {
 // AssetHaproxy returns asset data.
 // This is the base64 encoded gzipped contents of module/haproxy.
 func AssetHaproxy() string {
-	return "eJzMWc2O2zYQvu9TDPbSBEj8AAs0QLFNmwBtsoe9G2NyLBGhSIUc7cZvX/BHsn5ta9dB6pslzszH+fk4Q72Hb3S4gxJrZ38cbgBYsaY7uM1Pbm8AJHnhVM3Kmjv4cAMA7Xr418pG0w3AXpGW/i6+fA8GK+orDT8+1HQHhbNNnZ/M6D0qyn+P2vbOGiYjt+Fv93ak5QtWBHYPXFInAG+sA608kyH3Fp5LJUpwJEg9kQQ0EmpnBXlPMsoJawyJoG8zRbFD8W0NiLx+FsMzevCkSXCwbKFCgwWNMIQX4Ykn90RuBlF6cTEgjZ6zTFCdkIxMJmCGZ6yxZdTbZ1SsTLFlVdG28kt2H8NiCItAGaiU1sqTsEZ68DUZhqwnvA0QntAp23j43lBDfa0pd7Q1xRTREXeEdTVMe+tmQkGecaeVL9u47JVBnR16IeLdgclvHaE8DdI01Y5cCFyUAHZofKU4p0sEp1XEXFLyoLYFKA+UVm0uBBRdFp3+cyK5CkdbYdnvvyKO70AZoRsZxB2xU5dvIVfjBc48RtfR94Y8+5YWyFGPkna0ty6wgvJgDbUeziUcDV0KrnXtz0eXLf3modB2h3olTrWCYROrhlChlI68HzP8WU4n56zbVuQ9FosmP4ZFkBeFOivC7g/w6Y+HeBIqAwJ9RBX1TffK9INnEsY2TtD84qUIldSZTeKdL+xcVZGrlMHIkJ6RF7d4b41UqUBignnfHgbKHCmmfU5GBoaZmKusXLedIABcIg9P7ZBQNTmMRfzm8f4BrINPj48Pb0+dAYu8f28NozK+oyZhG8M+eK4nDShYPXVpnPN8Gst+GwMwbH/G4JLKwaszJSesEY1zgcX62OwA1DQiIVIpMTcja3PFBjO91fVAdmG8IspMKlcAWaKROtVvv0m7ItZJQ/BSqJ6V1m1a2gH3XxFuPuVO4f3SR9qepFkO6EdNTpERrVOVP6KKMN0h1DHbVnrc157H2xV77HmW6vyz2VtXRbYD3NmG+32StBFESe2p9oLCbmGo+maKGLXCoRdr5LJl+U0+oQYLKlU4TNjZDY7l1lJtHa+3NZEaG5o4NhPL+OSdt5ZstQQ5EjlvSsmVFoYSZw1I8pwPvaVM+fO4BNQxa16REisD1cN4PlpTa6sSsG9rJHjWlwXZgci8W2an+fTrzt6/yX5+6DsbCuSSXGANDO1kJrhUrhtVJ2cP2eGr0QeoHYUJFVRqfJLij2G4VcITOlFCrZtCmdBH4BMqjTtNYdof6Gr8kCtPnePCGlaGDI8L5JT3R0VZkN2c1LMc9j6QxrA7bJW3WzHstlZDOanpEjDainHZrASxoOES446K0NW+Lh7LSi4KhuLDaxNiQcUKD7w+FU4rWoLSXfUxL3LBg6YwGKGU/eeraXaGAR352ho/BDuw/VdUAo409m5NwhQxLzwP5QwvYM2NI7kV1n5TJxv9D6OXAF/jG9RwG5T9/oS6oVugUJWgjFQizT/deJQbmRJlarKSzXZeafe0mfPaDOKSUJI72fZNIf+jPIc2MAt32sYgQDbUejzR9XFQvc1Cx8VJ2y3ECbWK1D6cJOZbxMFgOd+JM3LjX1IdIak3nUuX9SwVx2zGjtvONQk7lf3f52seVUoMe+LGGZKAbdY+Ky5BsW+39ovTNmK4MGvT2p+WtA6ft9nIVitzMkj3tqo18TBLIEj17zEDqoq4tPJdtwaNTEJP5OKo5tkpU7wUdLy+jXfwIbC24a1ExuFd/AT96nvc47cLH2Z2hH2j9ZDS34GxnNqkIBlQnBgwL9zTFbcxxJxisXe26jP8m8EWdlYe3gLumVy+rXae42eBOPS3d51rdtntUCye3I/3D/GLQmrXXzEYjb7RzH86moW7xtGksU530vxM+WoEhaA6ZXr39Uto6+nmvwAAAP//o2OPYg=="
+	return "eJzMWc2O2zYQvu9TDPbSBEj8AAs0QLFNmwBtsoe9G2NyLBFLkQo52o3fvuCPZP3aVtZB6pslzszH+fk4Q72HJzrcQYm1s98PNwCsWNMd3OYntzcAkrxwqmZlzR18uAGAdj38a2Wj6QZgr0hLfxdfvgeDFfWVhh8farqDwtmmzk9m9B4V5b9HbXtnDZOR2/C3ezvS8gUrArsHLqkTgDfWgVaeyZB7Cy+lEiU4EqSeSQIaCbWzgrwnGeWENYZE0LeZotiheFoDIq+fxfCCHjxpEhwsW6jQYEEjDOFFeOLJPZObQZReXAxIo+csE1QnJCOTCZjhGWtsGfX2BRUrU2xZVbSt/JLdx7AYwiJQBiqltfIkrJEefE2GIesJbwOEZ3TKNh6+NdRQX2vKHW1NMUV0xB1hXQ3T3rqZUJBn3GnlyzYue2VQZ4deiHh3YPJbRyhPgzRNtSMXAhclgB0aXynO6RLBaRUxl5Q8qG0BygOlVZsLAUWXRaf/nEiuwtFWWPb7r4jjO1BG6EYGcUfs1OVbyNV4gTOP0XX0rSHPvqUFctSjpB3trQusoDxYQ62HcwlHQ5eCa13789FlS795KLTdoV6JU61g2MSqIVQopSPvxwx/ltPJOeu2FXmPxaLJj2ER5EWhzoqw+wN8+uMhnoTKgEAfUUV9070yfeeZhLGNEzS/eClCJXVmk3jnCztXVeQqZTAypGfkxS3eWyNVKpCYYN63h4EyR4ppn5ORgWEm5iorp9t5osOLdYt8F2SAS+ThwR1yqiaHsY7fPN4/gHXw6fHx4e2pY2CR+u+tYVTGd+wkbGPYB+f1pAEFq+cuk3OqT8PZ72QAhh3QGFxSOXh1puqENaJxLhBZH5sdgJoGJQQr5eZmZG2u3mCmvboeyC6MV0SZeeUKIEs0UqcS7vdpV8Q66Ql+FKpnpXWblnZA/1eEmw+6U3i/9JG2h2mWA/pek1NkROtU5Y+oIkx3CHXMtpUet7bn8XbFHtuepTr/bPbWVZHwAHe24X6rJG0EUVJ7sP1AYbcwVH0zRYxa4dCLNXLZEv0mH1KDBZUqHCbs7AYnc2upto7X25pIjQ1NHJuJZXz4zltLtlqCHImcN6XkSgtDibMGJHnO595Spvx5XALqmDWvSImVgephPB+tqbVVCdi3NRI868uC7EBk3i2zA336dWfv32Q/P/SdDQVySS6wBoaOMhNcKteNqpOzh+zw1egD1I7CkAoq9T5J8ccw3yrhCZ0oodZNoUzoI/AZlcadpjDwD3Q1fsiVp85xYQ0rQ4bHBXLK+6OiLMhuTupZDnsfSGPYHbbK260YNlyroZzUdAkYbcW4bFaCWNBwiXFHRWhsXxePZSUXBUPx4bUJsaBihQdenwqnFS1B6W77mBe54EFTmI1Qyv7z1TQ7w4COfG2NH4Id2P4rKgFHGnsXJ2GKmBeeh3KGF7DmxpHcCmuf1MlG/8PoJcDX+AY13AZlvz+jbugWKFQlKCOVSPNPNx7lRqZEmZqsZLOdV9o9bea8NoO4JJTkTrZ9U8j/KM+hDczCnbYxCJANtR5PdH2cVW+z0HFx0nYLcUitIrUPJ4n5FnE8W84344zc+B8pkJDXm86ry3qW6mM2aced55qcncr+71M2Tyslhj1x4wxJwDZxXxSXoNi3W/vFmRsxXJi4ae3PzFuHL9tsZ6uVORmne1vVmniYKBCk+heaAVhFXFr5rluDRiahZ3JxYPPslClegTte5cb7+BBe2/BWIuPwXn6ygdV3usfvGD4M7wj7Rusht78DYzn1S0EyoDgxaV64pytuY4g5hWPvbNWn+jeDLeysPLwF3DO5fHPtPMdPBHH6b+891+yy26FYPMIf7x/i14XUt79iQhp9r5n/jDQLd42jSWOd7qf5hfIdCQpBdUr27kuY0NbTzX8BAAD///t2lGI="
 }
diff --git a/filebeat/module/haproxy/log/_meta/fields.yml b/filebeat/module/haproxy/log/_meta/fields.yml
index 9176a8ae7282..65d8902c1c2c 100644
--- a/filebeat/module/haproxy/log/_meta/fields.yml
+++ b/filebeat/module/haproxy/log/_meta/fields.yml
@@ -14,7 +14,7 @@
     - name: captured_headers
       description: >
         List of headers captured in the response due to the presence of the "capture response header" statement in the frontend.
-      type: text
+      type: keyword
 
     - name: status_code
       type: alias
@@ -32,11 +32,11 @@
     - name: captured_headers
       description: >
         List of headers captured in the request due to the presence of the "capture request header" statement in the frontend.
-      type: text
+      type: keyword
 
     - name: raw_request_line
       description: Complete HTTP request line, including the method, request and HTTP version string.
-      type: text
+      type: keyword
 
     - name: time_wait_without_data_ms
       description: Total time in milliseconds spent waiting for the server to send a full HTTP response, not counting data.