logstash收集nginx日志

创建模版

使用 devtools 创建模板，或者创建的索引以 logstash开头，确保location类型为geo_point。

PUT _template/nginx
{
	"order": 0,
	"version": 60001,
	"index_patterns": [
		"nginx-*"
	],
	"settings": {
		"index": {
			"number_of_shards": "1",
			"refresh_interval": "5s"
		}
	},
	"mappings": {
		"properties": {
			"@timestamp": {
				"type": "date"
			},
			"geoip": {
				"dynamic": true,
				"properties": {
					"ip": {
						"type": "ip"
					},
					"latitude": {
						"type": "half_float"
					},
					"location": {
						"type": "geo_point"
					},
					"longitude": {
						"type": "half_float"
					}
				}
			},
			"body_bytes": {
				"type": "float"
			},
			"request_time": {
				"type": "float"
			},
			"response_code": {
				"type": "integer"
			},
			"@version": {
				"type": "keyword"
			}
		}
	},
	"aliases": {}
}

nginx 输出 json 格式日志

可以根据自己的需求，添加删除注释

log_format json   '{"@timestamp":"$time_iso8601",'
                       '"@source":"$server_addr",'
                       '"hostname":"$hostname",'
                       '"http_host":"$host",'
                       '"client":"$remote_addr",'
                       '"request_method":"$request_method",'
                       '"url":"$uri",'
                       '"http_version":"$server_protocol",'
                       '"scheme":"$scheme"'
                       '"response_code":"$status",'
                       '"body_bytes":"$body_bytes_sent",'
                       '"request_time":"$request_time",'
                       '"referer":"$http_referer",'
<s <a="" href="https://www.dazhuanlan.com">大专栏

【说明】：本文章由站长整理发布，文章内容不代表本站观点，如文中有侵权行为，请与本站客服联系(QQ:254677821)！