logstash grok切分nginx日志

最新推荐文章于 2023-09-22 12:01:01 发布

weixin_30663391

最新推荐文章于 2023-09-22 12:01:01 发布

阅读量585

点赞数

文章标签：运维 java

原文链接：http://www.cnblogs.com/lfdblog/p/11170735.html

版权

日志类型

map $http_x_forwarded_for $clientRealIp {
"" $remote_addr;
~^(?P<firstAddr>[0-9\.]+),?.*$ $firstAddr;
}

log_format  proxy_main  '$clientRealIp "$http_x_forwarded_for" $remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" $request_time $upstream_response_time '
                        '$proxy_host $upstream_addr';

日志格式

120.92.12.137 "1.1.1.1, 2.2.2.2" 120.92.12.137 - - [10/Jul/2019:03:38:16 +0000] "GET /api HTTP/1.1" 406 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.3 skyeye-scanner" 0.105 0.104 127.0.0.1:8080 127.0.0.1:8080

切分格式

(?<clientRealIp>%{IP}|-) \"(?<http_x_forwarded_for>([0-9., ]+|-))\"\s(?<remote_addr>%{IP}|-)\s-\s%{NOTSPACE:remote_user} \[%{HTTPDATE:time_local}\] \"%{WORD:method} (?<request_uri>(.*)) HTTP/%{NUMBER:http_version}\" %{NUMBER:status} (?:%{NUMBER:body_bytes}|-) \"%{NOTSPACE:http_referer}\" %{QS:agent} %{NUMBER:request_time} %{NUMBER:upstream_response_time} (?:%{HOSTPORT:proxy_host}|-) (?:%{HOSTPORT:upstream_addr}|-)

转载于:https://www.cnblogs.com/lfdblog/p/11170735.html