日志转化成json格式

apache_access.log

将LogFormat 原配置行注释。添加如下内容：

LogLevel warn

<IfModule log_config_module>

LogFormat "{

"@timestamp": "%{%Y-%m-%dT%H:%M:%S%z}t",

"@version": "1",

"tags":["apache"],

"message": "%h %l %u %t \"%r\" %>s %b",

"clientip": "%a",

"duration": %D,

"status": %>s,

"request": "%U%q",

"urlpath": "%U",

"urlquery": "%q",

"bytes": %B,

"method": "%m",

"site": "%{Host}i",

"referer": "%{Referer}i",

"useragent": "%{User-agent}i"

}" ls_apache_json

<IfModule logio_module>

CustomLog logs/access_log.ls_json ls_apache_json

重启apache程序

---------------------------------------------------------------------------------------------------

nginx_access.log

将log_format 原配置行注释，添加如下内容：

log_format logstash_json '{ "@timestamp": "$time_local", '

'"@fields": { '

'"remote_addr": "$remote_addr", '

'"remote_user": "$remote_user", '

'"body_bytes_sent": "$body_bytes_sent", '

'"request_time": "$request_time", '

'"status": "$status", '

'"request": "$request", '

'"request_method": "$request_method", '

'"http_referrer": "$http_referer", '

'"body_bytes_sent":"$body_bytes_sent", '

'"http_x_forwarded_for": "$http_x_forwarded_for", '

'"http_user_agent": "$http_user_agent" } }';

access_log /usr/local/nginx/logs/access_json.log logstash_json;

重启nginx程序

---------------------------------------------------------------------------------------------------

Tomcat 利用log4j，日志输出格式为json

进入到Tomcat的lib目录：

cd /usr/local/tomcat8.5.14/lib

wget http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.42/bin/extras/tomcat-juli-adapters.jar

wget https://archive.apache.org/dist/logging/log4j/1.2.17/log4j-1.2.17.jar

进入到Tomcat的bin目录：

cd /usr/local/tomcat8.5.14/bin

mv tomcat-juli.jar tomcat-juli.jar.bak

wget http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.42/bin/extras/tomcat-juli.jar

进入到Tomcat的conf目录：

mv logging.properties  logging.properties.bak

编辑 context.xml，将Context标题修改为如下内容：

<Context swallowOutput="true">

进入到tomcat的lib目录：

创建log4j.properties,其catalina日志为滚动日志,json格式输出

vim log4j.properties

log4j.rootLogger = INFO, CATALINA

# Define all the appenders

log4j.appender.CATALINA=org.apache.log4j.RollingFileAppender

log4j.appender.CATALINA.File=${catalina.base}/logs/catalina

log4j.appender.CATALINA.layout=org.apache.log4j.PatternLayout

log4j.appender.CATALINA.layout.ConversionPattern={"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n

log4j.appender.CATALINA.MaxFileSize=2MB

log4j.appender.CATALINA.MaxBackupIndex=10

log4j.appender.LOCALHOST = org.apache.log4j.DailyRollingFileAppender

log4j.appender.LOCALHOST.File = ${catalina.base}/logs/localhost

log4j.appender.LOCALHOST.Append = true

log4j.appender.LOCALHOST.Encoding = UTF-8

log4j.appender.LOCALHOST.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.LOCALHOST.layout = org.apache.log4j.PatternLayout

log4j.appender.LOCALHOST.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.MANAGER = org.apache.log4j.DailyRollingFileAppender

log4j.appender.MANAGER.File = ${catalina.base}/logs/manager

log4j.appender.MANAGER.Append = true

log4j.appender.MANAGER.Encoding = UTF-8

log4j.appender.MANAGER.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.MANAGER.layout = org.apache.log4j.PatternLayout

log4j.appender.MANAGER.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.HOST-MANAGER = org.apache.log4j.DailyRollingFileAppender

log4j.appender.HOST-MANAGER.File = ${catalina.base}/logs/host-manager

log4j.appender.HOST-MANAGER.Append = true

log4j.appender.HOST-MANAGER.Encoding = UTF-8

log4j.appender.HOST-MANAGER.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.HOST-MANAGER.layout = org.apache.log4j.PatternLayout

log4j.appender.HOST-MANAGER.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.CONSOLE = org.apache.log4j.ConsoleAppender

log4j.appender.CONSOLE.Encoding = UTF-8

log4j.appender.CONSOLE.layout = org.apache.log4j.PatternLayout

log4j.appender.CONSOLE.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

# Configure which loggers log to which appenders

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost] = INFO, LOCALHOST

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager] =

  INFO, MANAGER

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager] =

  INFO, HOST-MANAGER

重启Tomcat，并检查日志输出格式：

tail -f usr/log/tomcat8.5.14/logs/catalina

日志输出到catalina，而非catalina.out文件