1.修改nginx日志格式
vim /datas/soft/nginx/conf/nginx.conf
将默认日志这段给注释掉
改成json格式的
log_format json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr",'
'"http_host":"$host",'
'"url":"$uri",'
'"referer":"$http_referer",'
'"agent":"$http_user_agent",'
'"status":"$status"}';
access_log /var/log/nginx/access_json.log json;
nginx -s reload
测试文件:
[root@node1 logstash-6.4.0]# vim config/file.conf
input {
file {
path => "/var/log/nginx/access.log"
codec => json
start_position => "beginning"
}
}
output {
stdout {
codec => rubydebug
}
}
[root@node1 logstash-6.4.0]# ./bin/logstash -f config/file.conf
...
....
{
"upstreamtime" => "-",
"referer" => "-",
"clientip" => "192.168.10.1",
"url" => "/index.html",
"agent" => "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36",
"@timestamp" => 2018-09-03T07:29:29.000Z,
"path" => "/var/log/nginx/access.log",
"upstreamhost" => "-",
"@version" => "1",
"responsetime" => 0.0,
"http_host" => "192.168.10.14",
"status" => "304",
"host" => "192.168.10.14",
"size" => 0
}
...
....
查看下访问日志,发现变成JSON格式了
写入elasticsearch中
input {
file {
path => "/var/log/nginx/access.log"
codec => json
type => "ngxin-log"
start_position => "beginning"
}
}
output {
if [type] == "nginx-log"{
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "nginx-log-%{+YYYY.MM.dd}"
}
}