logstash收集Nginx日志,转换为JSON格式

Nginx日志处理为JSON格式,并放置在http区块:

  log_format  json  '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":"$body_bytes_sent",'
'"responsentime":"$request_time",'
'"referer":"$http_referer",'
'"useragent":"$http_user_agent"'
'}';
access_log logs/access_json.log json;

Nginx日志格式

logstash配置文件:

 input {
file {
path =>"/usr/local/nginx/logs/access_json.log"
codec =>"json"
start_position => "beginning" }
} filter{
json {
source => "message"
skip_on_invalid_json => true
}
}
output{ elasticsearch {
hosts =>["172.16.3.160:9200"]
index => "logstash-zabbix-nginx-log-%{+YYYY.MM.dd}" }
}

logstash配置文件

上一篇:rsyslog日志总结


下一篇:安卓项目-利用Sqlite数据库,开发新闻发布系统