Nginx 日志改成 JSON 格式

Nginx 日志默认为普通文本的格式，例如，下面是 Nginx 的一行访问日志：

10.88.122.105 - - [02/Dec/2017:09:15:04 +0800] "GET /js/pagination.js HTTP/1.1" 304 0 "http://10.88.105.20:8063/stockrecommand.html" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" "-" 0.000

　　

为了便于利用 Elastic Stack 日志平台收集展示 Nginx 的日志，可以将 Nginx 的日志改成 json 的格式。修改后的 json 日志格式如下所示：

{ "@timestamp": "12/Dec/2017:14:30:40 +0800", "remote_addr": "10.88.122.108", "referer": "-", "request": "GET / HTTP/1.1", "status": 304, "bytes":0, "agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36", "x_forwarded": "-", "up_addr": "-","up_host": "-","up_resp_time": "-","request_time": "0.000" }

　　

为了修改 Nginx 的日志格式改成 json，需要修改 Nginx 的配置文件，笔者 Nginx 的配置文件为 /usr/local/nginx/conf/nginx.conf。

http {     include       mime.types;     default_type  application/octet-stream;     charset  utf-8;       log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '                       '$status $body_bytes_sent "$http_referer" '                       '"$http_user_agent" "$http_x_forwarded_for" $request_time';       log_format log_json '{ "@timestamp": "$time_local", ' '"remote_addr": "$remote_addr", ' '"referer": "$http_referer", ' '"request": "$request", ' '"status": $status, ' '"bytes": $body_bytes_sent, ' '"agent": "$http_user_agent", ' '"x_forwarded": "$http_x_forwarded_for", ' '"up_addr": "$upstream_addr",' '"up_host": "$upstream_http_host",' '"up_resp_time": "$upstream_response_time",' '"request_time": "$request_time"' ' }';       access_log  logs/access.log log_json;       (省略内容) }

　　

user www;
worker_processes auto;

events {
    worker_connections  4096;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format main  escape=json '$remote_addr - [$time_local] "$request" '
                     '$status $body_bytes_sent $request_body "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for" '
                     '"$request_time $upstream_connect_time $upstream_addr $upstream_header_time $upstream_response_time" '
                     '"$server_name"';
     sendfile on;
     tcp_nopush on;
     tcp_nodelay on;
     keepalive_timeout 600;
     types_hash_max_size 2048;
     server_tokens off;
     server_tag off;
     server_info off;
     server_names_hash_bucket_size 512;

     #ssl
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
     ssl_prefer_server_ciphers on;


     #gzip
     gzip on;
     gzip_disable "msie6";
     gzip_vary on;
     gzip_proxied any;
     gzip_comp_level 6;
     gzip_buffers 32 64k;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/jpeg image/gif image/png;

     include conf.d/*.conf;
}
                     

 

在 Nginx 的配置文件nginx.conf中，我们定义了两种的日志格式：main和log_json，其中，main为普通的文本格式，log_json为 json 格式。log_json其实就是手工构造一个 json 字符串。定义了 json 的日志格式后，便可以指定 access log 为 json 格式：

access_log logs/access.log log_json;

修改 Nginx 的配置，重启 Nginx ，便可以看到 json 格式的日志，重启 Nginx：

nginx -s reload
 

实例配置：

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '                       '$status $body_bytes_sent "$http_referer" '                       '"$http_user_agent" "$http_x_forwarded_for" "$request_time"';     log_format log_json '{ "@timestamp": "$time_local", '                         '"remote_addr": "$remote_addr", '                         '"referer": "$http_referer", '                         '"request": "$request", '                         '"status": $status, '                         '"bytes": $body_bytes_sent, '                         '"agent": "$http_user_agent", '                         '"x_forwarded": "$http_x_forwarded_for", '                        # '"up_addr": "$upstream_addr",'                        # '"up_host": "$upstream_http_host",'                        # '"up_resp_time": "$upstream_response_time",'                         '"request_time": "$request_time"'                         ' }';     access_log  /var/log/nginx/access.log  log_json;

　　

nginx 日志输出格式   { "@timestamp": "13/Feb/2019:02:26:36 +0000", "remote_addr": "172.20.1.238", "referer": "-", "request": "GET / HTTP/1.1", "status": 304, "bytes": 0, "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36", "x_forwarded": "125.118.223.90", "request_time": "0.000" }