ELK日志-logstash的tcp日志收集使用nginx反向代理之后获取真实的IP地址

logstash 的配置：proxy_protocol 设置为 true

input {
    #开启远程输入日志服务
    tcp {
        port => "4560"
        mode => "server"
        type => "log4j2"
        proxy_protocol => true #开启后能获取到代理IP和真实IP地址，并且开启后只能通过nginx代理连接，不能直接连接
    }
}

output {
    stdout { 
        codec => rubydebug
    }
}

nginx 配置

stream {
    upstream logstash {
        hash $remote_addr consistent;
        server 192.16.19.107:4560;
        server 192.16.19.108:4560;
    }
    server {
        listen       5560;
        proxy_pass   logstash;
        proxy_protocol on;
    }
}

输出的日志内容

{
    "proxy_port" => "5560",
    "@timestamp" => 2018-04-03T08:26:55.109Z,
          "port" => "64395",
    "proxy_host" => "192.16.19.107", #nginx的代理IP地址
      "@version" => "1",
          "host" => "162.8.19.8",  #真实客户端的IP址址
      "@metdata" => {
        "ip_address" => nil
    },
       "message" => "log message",
          "type" => "log4j2"
}