搭建logstash+kibana+elasticsearch+redis 搜集nginx日志信息

1,前台启动elasticsearch

/usr/local/elasticsearch/bin/service/elasticsearch -f

2，查看elasticsearch启动状态

curl -X GET http://192.168.60.237:9200/

3,前台启动收集日志agent

/logstash agent    -f ../logstash_agent.conf

4,前台启动转发日志agent

/usr/local/logstash/bin/logstash  agent -f   logstash_indexer.conf

5，前台启动redis-server

/home/joeyon/test/elk/redis-2.8.12/src/redis-server

6，前台启动kibana

/var/local/kibana-4.1.0-linux-x64/bin/kibana

7，通过访问kibana，检查是否配置成功

http://192.168.xx.xxx:5601/

备注：

1，logstash_agent.conf配置文件

input {
        file {
                type => "nginx_access"
                path => ["/var/local/nginx1.8.0/logs/access.log"]
        }
}
output {
        redis {
                host => "localhost"
                data_type => "list"
                key => "logstash:redis"
        }
}

2，logstash_indexer.conf配置文件

input {
        redis {
                host => "localhost"
                data_type => "list"
                key => "logstash:redis"
                type => "redis-input"
        }
}
filter {
        grok {
                type => "nginx_access"
                match => [
                        "message", "%{IPORHOST:http_host} %{IPORHOST:client_ip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})\" %{NUMBER:http_status_code} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time_duration:float} %{NUMBER:time_backend_response:float}",
                        "message", "%{IPORHOST:http_host} %{IPORHOST:client_ip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})\" %{NUMBER:http_status_code} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} %{NUMBER:time_duration:float}"
                ]
        }
}
output {
        elasticsearch {
                embedded => false
                protocol => "http"
                host => "localhost"
                port => "9200"
        }
}

3，三件套下载地址

https://www.elastic.co/downloads

参考：

参考：
http://www.cnblogs.com/yjf512/p/4199105.html
http://www.cnblogs.com/adolfmc/p/4059215.html
http://www.wklken.me/posts/2015/04/26/elk-for-nginx-log.html

http://kibana.logstash.es/