log_format json ‘{"@timestamp":"$time_iso8601",‘

                 ‘"host":"$server_addr",‘

                 ‘"clientip":"$remote_addr",‘

                 ‘"size":$body_bytes_sent,‘

                 ‘"responsetime":$request_time,‘

                 ‘"upstreamtime":"$upstream_response_time",‘

                 ‘"upstreamhost":"$upstream_addr",‘

                 ‘"http_host":"$host",‘

                 ‘"url":"$uri",‘

                 ‘"xff":"$http_x_forwarded_for",‘

                 ‘"referer":"$http_referer",‘

                 ‘"agent":"$http_user_agent",‘

                 ‘"status":"$status"}‘;

1. nginx.conf 添加log_format json 格式模板

2. 

3. vhost内conf模块添加输出日志格式模板 并重新启动nignx

   access_log /www/wwwlogs/app..plus.log json;
   4.cat app..plus.log | awk -F ‘,‘ ‘{print $10}‘|sort|uniq -c|sort -rn|head -n 3

nginx日志格式化json字串