nginx + tomat日志 格式对应

&#44 表示xml中的逗号
&quot 表示引号
#tomcat的日志格式化

pattern="{"remote_addr":"%{X-Forwarded-For}i","local_addr":"%h","user":"%{username}r","time":"%t","url":"%r","status":"%s","body_bytes_sent":"%b","request":"%D"}"

对应日志格式

"remote_addr":"-","local_addr":"192.168.0.49","user":"-","time":"[08/Nov/2018:00:13:05 -0500]","url":"GET /TEST/index.html HTTP/1.1","status":"200","body_bytes_sent":"25","request":"1"}

nginx日志格式化

log_format logstash_json  '{ "@timestamp": "$time_local",'
                         '"@fields": { '
                         '"remote_addr":"$remote_addr", '
                         '"remote_user":"$remote_user", '
                         '"body_bytes_sent":"$body_bytes_sent",'
                         '"status":"$status",'
                         '"request_time":"$request_time", '
                         '"upstream_addr":"$upstream_addr",'
                         '"upstream_connect_time":"$upstream_connect_time",'
                         '"upstream_response_time":"$upstream_response_time", '
                         '"request": "$request",'
                         '"request_method": "$request_method", '
                         '"http_referrer": "$http_referer", '
                         '"body_bytes_sent":"$body_bytes_sent", '
                         '"http_x_forwarded_for": "$http_x_forwarded_for",'
                         '"http_user_agent": "$http_user_agent" } }';
                       

access_log /var/log/nginx/access.log logstash_json;
对应nginx的日志格式

{ "@timestamp": "04/Sep/2018:14:12:19 +0800","@fields": { "remote_addr":"192.168.0.125", "remote_user":"-", "body_bytes_sent":"169","status":"403","request_time":"0.000", "upstream_addr":"-","upstream_connect_time":"-","upstream_response_time":"-", "request": "GET / HTTP/1.1","request_method": "GET", "http_referrer": "-", "body_bytes_sent":"169", "http_x_forwarded_for": "-","http_user_agent": "curl/7.29.0" } }