ELK如何分析nginxaccess日志
ELK如何分析nginx access日志,相信很多没有经验的人对此束手无策,为此本文总结了问题出现的原因和解决方法,通过这篇文章希望你能解决这个问题。
站在用户的角度思考问题,与客户深入沟通,找到榕江网站设计与榕江网站推广的解决方案,凭借多年的经验,让设计与互联网技术结合,创造个性化、用户体验好的作品,建站类型包括:网站制作、网站设计、企业官网、英文网站、手机端网站、网站推广、域名申请、虚拟空间、企业邮箱。业务覆盖榕江地区。
注意:修改配置后建议重新创建index
1、nginx 日志文件格式
log_format elk "$http_clientip | $http_x_forwarded_for | $time_local | $request | $status | $body_bytes_sent | " "$request_body | $content_length | $http_referer | $http_user_agent | " "$http_cookie | $remote_addr | $hostname | $upstream_addr | $upstream_response_time | $request_time";
2、logstash nginx 服务器上的配置文件 agent.conf
input { file { type => "elk_frontend_access" path => ["/data/logs/flight1-access_log"] } } filter { ruby { init => "@kname = ['http_clientip','http_x_forwarded_for','time_local','request','status','body_bytes_sent','request_body','content_length','http_referer','http_user_agent','http_cookie','remote_addr','hostname','upstream_addr','upstream_response_time','request_time']" code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split('|'))]) new_event.remove('@timestamp') event.append(new_event)" } if [request] { ruby { init => "@kname = ['method','uri','verb']" code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('request').split(' '))]) new_event.remove('@timestamp') event.append(new_event) " } if [uri] { ruby { init => "@kname = ['url_path','url_args']" code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('uri').split('?'))]) new_event.remove('@timestamp') event.append(new_event) " } kv { prefix => "url_" source => "url_args" field_split => "& " remove_field => [ "url_args","uri","request" ] } } } mutate { convert => ["body_bytes_sent" , "integer", "content_length", "integer", "upstream_response_time", "float","request_time", "float"] } date { match => [ "time_local", "dd/MMM/yyyy:hh:mm:ss Z" ] locale => "en" } grok { match => { "message" => "%{IP:clientip}" } } geoip { source => "clientip" } } output { redis { host => "10.10.45.200" data_type => "list" key => "elk_frontend_access:redis" port=>"5379" } }
3、logstash elk服务器上的配置文件server.conf
input { redis { host => "10.10.45.200" data_type => "list" key => "elk_frontend_access:redis" port =>"5379" } } output { elasticsearch { hosts => "10.10.45.200:8200" index => "logstash-zjzc-frontend-%{+YYYY.MM.dd}" } stdout { codec => rubydebug } }
注意:如果修改后没有生效,在kibana上重建索引。
看完上述内容,你们掌握ELK如何分析nginx access日志的方法了吗?如果还想学到更多技能或想了解更多相关内容,欢迎关注创新互联行业资讯频道,感谢各位的阅读!
网页题目:ELK如何分析nginxaccess日志
网页地址:http://pwwzsj.com/article/jjojgs.html