Aug  5 16:36:12 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:12 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385747637 HTTP/1.1" - 

200 1800 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -

Aug  5 16:36:13 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.252.142.174 [05/Aug/2016:16:36:13 +0800] "GET /resources/images/home/login_after_summary_bg.6771b127.jpg HTTP/1.1" - 200 1115 

"https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.000 -

Aug  5 16:36:37 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:37 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385772954 HTTP/1.1" - 

200 1800 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -

^C

www.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:37 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385772954 HTTP/1.1" - 200 1800 "https://www.zjcap.cn/" 

"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -

nginx 配置:

user  nginx;

worker_processes  1;

syslog local5 nginx-zjzc01;

然后rsyslog 根据nginx-zjzc01 去匹配 写到不同的日志目录