The example is just a configuration making health checks look like real PSQL startup messages (by artificially constructing them). It does not read or match anything.
You can match in the frontend whatever you want, however finding exactly what you are looking for is something that can be complex, depending where you need to look for it.
In the postgresql startup message for example, the username is send first, so the offset in the packet where you can find the database name is different based on the username length.
The following works, but requires some low-level tinkering:
First, transform your database name in hex, without spaces and with uppercase letters:
lukas@dev:~/haproxy$ echo -n "virtuoso" | od -A n -t x1 | sed 's/ //g' | tr '[:lower:]' '[:upper:]'
76697274756F736F
lukas@dev:~/haproxy$
Postgresql will send null terminated strings like this:
user\0actualusername\0database\0actualdatabase\0\0
You can access the packet payload and basically look for database\0virtuoso\0 by concatenating database\0 (646174616261736500) with the hex representation of your database name virtuoso (76697274756F736F) and another null byte (00).
Frontend would look like this (please also replace the tcp-request content rules, as the following code properly waits for the entire message to be terminated - instead of artificially delaying all database connections for 1 second like in your case):
# check if the payload is terminated with two null bytes
# (skipping static packet length and procotol version headers)
acl pgsql_msg_termination req.payload(8,0),hex -m end 0000
tcp-request inspect-delay 5s
tcp-request content accept if pgsql_msg_termination
acl postgresql req.payload(8,0),hex -m sub 646174616261736500706F737467726573716C00
use_backend postgresql if postgresql
acl virtuoso req.payload(8,0),hex -m sub 64617461626173650076697274756F736F00
use_backend virtuoso if virtuoso