ELK監控nginx日志的整體流程

  log_format main_json '{"@timestamp": "$time_local", '
                        '"remote_addr": "$remote_addr", '
                        '"referer": "$http_referer", '
                        '"request": "$request", '
                        '"status": $status, '
                        '"bytes": $body_bytes_sent, '
                        '"agent": "$http_user_agent", '
                        '"x_forwarded": "$http_x_forwarded_for", '
                        '"up_addr": "$upstream_addr",'
                        '"up_host": "$upstream_http_host",'
                        '"up_resp_time": "$upstream_response_time",'
                        '"request_time": "$request_time"'
                        ' }';
    access_log  logs/access.log main_json; # 引用日志格式名稱

{
    "@timestamp": "25/Feb/2022:10:58:15 +0800",
    "remote_addr": "192.168.2.95",
    "referer": "-",
    "request": "GET /api/getScreenshot?url=http://www.qhjyedu.com/0e/bd/c12a3773/page.htm&path=/data2/ncs-cyber/mirror/page_image/situation_image/gdzx20211020/ddd38417-971b-400f-b430-834022c57d97.png&errorKeyWord=中國民族偉大復興&successKeyWord=中華民族偉大復興 HTTP/1.1",
    "status": 304,
    "bytes": 0,
    "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36",
    "x_forwarded": "-",
    "up_addr": "192.168.3.222:9848",
    "up_host": "-",
    "up_resp_time": "12.193",
    "request_time": "12.193"
}

input {
    file {
        path => ["/usr/local/nginx/logs/access.log"]   # 讀取日志文件的路徑
	start_position => "beginning"
	codec => json {    # 這里是將json字符串轉化為json，不然的話會在es中存一個<屬性,json字符串>
		charset => ["UTF-8"]
		}
    }
}
filter {  # 簡單處理，無過濾操作
    }
output {
    elasticsearch {
        hosts => ["你的ip:port"]  # 你的es的ip+端口
	index => "logstash-nginx-access-%{+YYYY.MM.dd}" # 你的索引名
	
    }
    stdout {
        codec => rubydebug
    }
}

logstash-6.7.2/bin/./logstash -f /home/xxx/nginx_access.conf --path.data=/home/xxx/logstash