elk收集nginx日志(json格式)

收集 Nginx 业务日志
收集 Nginx 业务日志
1 Nginx json 日志格式定义
2 filebeat 多日志收集
1 Nginx json 日志格式定义

[root@zhimai-web01 ~]# vim /etc/nginx/nginx.conf
......
    log_format  main    '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';
    log_format main_json '{"@timestamp":"$time_local",'
                         '"N_client_ip": "$remote_addr",'
                         '"N_request": "$request",'
                         '"N_request_time": "$request_time",'
                         '"N_status": "$status",'
                         '"N_bytes": "$body_bytes_sent",'
                         '"N_user_agent": "$http_user_agent",'
                         '"N_x_forwarded": "$http_x_forwarded_for",'
                         '"N_referer": "$http_referer"'
                         '}';
......

2 filebeat 多日志收集

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  tags: ["web","zhimai-nginx"]
  json.keys_under_root: true
  json.overwrite_keys: true
output.redis:
  hosts: ["172.17.19.xx"]
  port: 6789
  password : 'xxxxxxxx'
  key: "filebeat-1916"
  db: 1
  timeout: 5