用ELK监控Nginx

最新推荐文章于 2024-05-08 04:12:28 发布

我不是稻草人

最新推荐文章于 2024-05-08 04:12:28 发布

阅读量704

点赞数

分类专栏： ELK Nginx

本文链接：https://blog.csdn.net/junqing124/article/details/78185955

版权

ELK 同时被 2 个专栏收录

6 篇文章 0 订阅

订阅专栏

Nginx

3 篇文章 0 订阅

订阅专栏

nginx日志格式为:

        log_format main '$remote_addr [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" $upstream_response_time';
        access_log /home/log/nginx/access.log main;

nginx服务器上的logstash配置为:

input {
    file {
        path => ["/home/log/nginx/access.log"]
    }
}
filter {
    grok {
        match => {
            #"message" => "%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" \"(?<http_user_agent>\S+)\" \"(?<http_x_forwarded_for>\S+)\""
                "message" => "%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" %{NUMBER:response_time}"
        }
    }
    mutate {
        convert => ["response_time", "float"]
    }
}
output {
    elasticsearch {
        hosts => ["192.168.6.11:9200"]
        index => "nginx-%{+YYYY.MM.dd}"
        workers => 1
        flush_size => 1
        idle_flush_time => 1
        template_overwrite => true
    }
}