使用logstash分析nginx日志 elasticsearch存储日志 kibana展示日志

女爷i 2023-02-23 08:28 51阅读 0赞

## 1 配置nginx ##

log_format  main  '$remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" $request_time "$upstream_addr" $upstream_response_time "$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;

配置完成后，启动nginx

# nginx

## 2 配置logstash ##

新建一个nginx.conf，内容如下

input {
              file {
                       path => ["/var/log/nginx/access.log"]
                       type => "access"
                       start_position => "beginning"
                             }
    }
    filter {
        if [type] == "access" {
              grok {
                       match => { "message" => "^%{IPV4:remote_addr} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{INT:status} %{INT:body_bytes_sent} \"%{NOTSPACE:http_referer}\" %{NUMBER:request_time} \"%{DATA:http_user_agent}\" \"%{NOTSPACE:http_x_forwarded_for}\"" }
                              }
              geoip {
                       source => "remote_addr"
                     }
                                }
    }
    output {
              stdout { codec => rubydebug }
              elasticsearch {
                        hosts => "192.168.122.8:9200"
                               }
    }

启动logstash

# ./bin/logstash -f nginx.conf

## 3 启动es、kibana ##

## 4 查看kibana页面 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JveHJpY2UwMDc_size_16_color_FFFFFF_t_70][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JveHJpY2UwMDc_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200706162329489.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JveHJpY2UwMDc=,size_16,color_FFFFFF,t_70