配置logstash收集nginx的日志

 

0.默认已经安装了ELK，并已经成功运行。如需安装，请移步此处。

#请将文中所有的ip地址换成你的主机ip地址

1.安装nginx服务

1.1更新包源

sudo apt-get update

1.2直接使用apt进行安装

sudo apt-get install nginx

1.3修改配置文件

1.3.1修改全局配置文件

sudo vim /etc/nginx/nginx.conf

#添加以下配置

        #added by lim for server configuration
        include /etc/nginx/server/*.conf;
        #added by lim for log to json
        log_format  access_json  '{"@timestamp":"$time_iso8601",'
                      '"@version":"1",'
                      '"client":"$remote_addr",'
                      '"url":"$uri",'
                      '"status":"$status",'
                      '"domain":"$host",'
                      '"host":"$server_addr",'
                      '"size":"$body_bytes_sent",'
                      '"responsentime":"$request_time",'
                      '"referer":"$http_referer",'
                      '"useragent":"$http_user_agent",'
                      '"upstreampstatus":"$upstream_status",'
                      '"upstreamaddr":"$upstream_addr",'
                      '"upstreamresponsetime":"$upstream_response_time"'
                       '}';

1.3.2新建文件夹用来存放server配置

sudo mkdir /etc/nginx/server/

1.3.3添加配置文件

sudo vim /etc/nginx/server/default.conf

#在文件中添加以下配置项

server {
    listen       80;        #监听80端口
    server_name  192.168.108.117; #监听的域名
    location / {            #转发或处理
        proxy_pass https://192.168.108.117;
    }
    error_page   500 502 503 504  /50x.html;#错误页
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
    location /nginxweb{
        root html;
        index index.html index.htm;
    }
}

1.4启动服务

sudo /etc/init.d/nginx start

1.5其他相关命令

#停止nginx服务
sudo nginx -s stop
#重启nginx服务
sudo nginx -s reload
#查看日志
tail /var/log/nginx/access.log

2.logstash相关配置

2.1修改配置文件：

sudo vim /etc/logstash/conf.d/nginx-accesslog.conf

#新建文件后添加以下配置项

input{
file {
   path => "/var/log/nginx/access.log"
   type => "nginx-access-log"
   start_position => "beginning"
   stat_interval => "2"
}
}
output{
   elasticsearch{
     hosts =>["192.168.108.117:9200"]
     index =>"nginx-access-log-%{+YYYY.MM.dd}.log"
}
}

2.2测试配置文件是否语法正确

usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/nginx-accesslog.conf -

2.3重新启动logstash

sudo systemctl restart logstash

如果安装了elasticsearch-head，可以看到集群中多了一个分片。如要安装，请移步此处。