FileBeat的版本为7.3.2,版本不同添加的参数不同!!!
第一步:改Ngnix
编辑ngnix.conf文件,在http模块下如下添加
http {
include mime.types;
default_type application/octet-stream;
#这里是默认给的示例
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
#z这里默认的是main
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" '
'$http_host '
' $upstream_response_time $request_time $upstream_addr ';
#在此处添加
log_format log_json '{"@timestamp": "$time_local","user_ip":"$http_x_real_ip","lan_ip":"$remote_addr","log_time":"$time_iso8601","user_req":"$request","http_code":"$status","body_bytes_sents":"$body_bytes_sent","req_time":"$request_time","user_ua":"$http_user_agent"}';
#最后指定log文件输出的类型为上方添加的log_json
access_log /var/log/nginx/access.log log_json;
#下面的http模块的其它配置不做展示
...
然后可以重启ngnix验证日志是否改为了json.
./nginx -s reload
第二步:修改FileBeat
接着修改FileBeat的配置文件filebeat.yml
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/nginx/access.log #指定监听的日志
#- c:\programdata\elasticsearch\logs\*
#主要是添加下方三个配置,记得和上方的paths对其(它们属于同级)
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
最后重启FileBeat,去ES插件上查看log日志是否已经为json
更改完成!
FileBeat的版本为7.3.2,版本不同添加的参数不同!!!