码迷,mamicode.com
首页 > 其他好文 > 详细

ELK-Logstash Nginx 日志分析

时间:2016-06-16 13:28:06      阅读:443      评论:0      收藏:0      [点我收藏+]

标签:elk logstash kibana elasticsearch

logstash配置文件

# nginx_log.conf

input {
        file {
                type => "nginx_log"
                path => "/opt/nginx/logs/access.log"
        }
}
  
filter {
  if [type] == "nginx_log" {
    grok {
      match => { "message" => "%{NGINXACCESS}" }
    }
   if ([message] =~ "^*launcher*|^*favicon*") {
      drop {}
   }
    geoip {
      source => "remote_addr"
      target => "geoip"
      database => "/opt/logstash-2.0.0/conf/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {

      convert => [ "[geoip][coordinates]","float", "body_bytes_sent","float", \

          "body_bytes_sent.raw","float"]

    }
  }
}
output {
    stdout { codec => rubydebug }
    elasticsearch {
        hosts => "192.168.0.100:9200"
        index => "ngx_log-%{+YYYY.MM}"
    }
}


NGINXACCESS 定义,可写在patterns/nginx 文件里

NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:remote_addr} - - \[%{HTTPDATE:time_local}\] "%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}

 

kibana 形图展示

技术分享

ELK-Logstash Nginx 日志分析

标签:elk logstash kibana elasticsearch

原文地址:http://cqfish.blog.51cto.com/622299/1789823

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!