Nginx日志处理为JSON格式，并放置在http区块：
log_format json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":"$body_bytes_sent",'
'"responsentime":"$request_time",'
'"referer":"$http_referer",'
'"useragent":"$http_user_agent"'
'}';
access_log logs/access_json.log json;
Nginx日志格式
logstash配置文件：
input {
file {
path =>"/usr/local/nginx/logs/access_json.log"
codec =>"json"
start_position => "beginning"
}
}
filter{
json {
source => "message"
skip_on_invalid_json => true
}
}
output{
elasticsearch {
hosts =>["172.16.3.160:9200"]
index => "logstash-zabbix-nginx-log-%{+YYYY.MM.dd}"
}
}
logstash配置文件