ELK(6)：ELK-logstash收集Nginx日志

电玩女神 2021-10-29 15:12 467阅读 0赞

# ELK(6)：ELK-logstash收集Nginx日志 #

暂时先用logstash收集，后面才改用filebeat，别着急

我的Nginx和logstash装一台机器的

## 将Nginx日志转成json ##

nginx.conf 日志模块修改为：

log_format logstash_json  '{"@timestamp":"$time_iso8601",'
    
                      '"host":"$server_addr",'
    
                      '"clientip":"$remote_addr",'
    
                      '"remote_user":"$remote_user",'
    
                     # '"request":"$request",' #和url一样，多一个请求方式和协议
    
                      '"http_user_agent":"$http_user_agent",'
    
                      '"size":$body_bytes_sent,'
    
                      '"responsetime":$request_time,'
    
                      '"upstreamtime":"$upstream_response_time",'
    
                      '"upstreamhost":"$upstream_addr",'
    
                      '"request_method": "$request_method",'
    
                      #'"requesturi":"$request_uri",' #和url一样
    
                      '"url":"$uri",'
    
                      '"domain":"$host",'
    
                      '"xff":"$http_x_forwarded_for",'
    
                      '"referer":"$http_referer",'
    
                      '"status":"$status"}';

虚拟主机日志处理配置：

access_log  logs/kibana.log  logstash_json;

## logstash配置文件 ##

#[admin@pe-jira conf.d]$ pwd
    
    #/etc/logstash/conf.d
    
    #[admin@pe-jira conf.d]$ cat logstash.conf
    
    input {
    
        file {
    
            type => "pe-jira-kibana"
    
            path => "/home/admin/webserver/logs/kibana.log"
    
            start_position => "beginning"
    
            stat_interval => "2"
    
        }
    
    }
    
    #我在input 中添加  codec = json 我设置不起作用，只能采用这个方式，其实应该是可以的
    
    filter{
    
       json {
    
                    source => "message"
    
                    skip_on_invalid_json => true
    
                    }
    
    }
    
    output {
    
      if [type] == "pe-jira-kibana" {
    
        elasticsearch {
    
          hosts => ["10.6.76.27:9200"]
    
          index => "logstash-pe-jira-nginx-kibana-%{+YYYY.MM.dd}"
    
          }
    
      }
    
    }

## 检查配置文件、重启 ##

这个你肯定知道这么做的呀

## 测试 ##

![1131047-20190716090124535-623792411.png][]

![1131047-20190716090127855-1855218767.png][]

![1131047-20190716090134523-92577078.png][]

查看json数据

![1131047-20190716090143523-1015640107.png][]

根据字段查看

![1131047-20190716090147364-892916227.png][]

转载于:https://www.cnblogs.com/wangxu01/articles/11192805.html

[1131047-20190716090124535-623792411.png]: /images/20211029/dc9660cbd6334f3681eeafcfd7b03341.png
[1131047-20190716090127855-1855218767.png]: /images/20211029/8dbbcb4a968e44c6ac69284d0cfc59cc.png
[1131047-20190716090134523-92577078.png]: /images/20211029/956ee84455e04ecbab594dcfe76c7376.png
[1131047-20190716090143523-1015640107.png]: /images/20211029/3077af3fb89e43a4941302817637bdcd.png
[1131047-20190716090147364-892916227.png]: /images/20211029/40c6d7e5140f4596aeb1b346ef30747f.png