ELK收集nginx日志

配置nginx 正则表达式

路径：

/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns

正则表达式：

URIPARAM1 [A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*

NGINXACCESS %{IPORHOST:client_ip} (%{USER:ident}|- ) (%{USER:auth}|-) \[%{HTTPDATE:timestamp}\] 
"(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)" %{NUMBER:status} 
(?:%{NUMBER:bytes}|-) "(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}"

 

然后配置logstash 的conf.d的目录

 

新建nginx.conf

 

input {
      file {
            path => "/var/log/nginx/access.log"
            type => "nginx-log"
            start_position => "beginning"

}
}
filter{
         grok{

         match => {"message" => "%{NGINXACCESS}"}
}

}
output {
          elasticsearch {

              hosts => "192.168.253.225:9200"
              index => "nginx_log-%{+YYYY.MM.dd}"

　　

 

 重启 logstash

systemctl restart logstash

 

压力测试

yum -y install epel-release httpd-tools

ab  -n  1000  -c  200 http://192.168.253.232/index.html

这个是测试报错信息的

/usr/share/logstash/bin/logstash -rf /etc/logstash/conf.d/nginx.conf

 

 

然后去kibana

创建索引

定制日志趋势图

 

 

 

 

 

 

 

欢迎进群讨论：QQ群294668383（有意向可以添加）