Shulou(Shulou.com)06/02 Report--

Xiaosheng blog: http://xsboke.blog.51cto.com

-Thank you for your reference. If you have any questions, you are welcome to communicate.

Catalogue

Requirements environment logstash configuration kibana configuration requirements use Geoip to parse the nginx user IP geographic location, and then map the user geographic location visualization environment through kibana's "coordinates map"

This document mainly shows the configuration of logstash filter plugin and kibana. For previous configurations, please refer to: ELK7.4- Quick start for data collection.

Web 172.16.100.251 nignx/filebeat/logstash elasticsearch 172.16.100.252 elasticsearch/kibanaWeb configuration

Add pipelines configuration

Vim / etc/logstash/conf.d/nginx.confinput {beats {port = > 5044} filter {if "nginx_access" in [tags] {grok {match = > {"message" > "% {NUMBER:request_time}\ |% {IPORHOST:access_domain}\ |% {IPORHOST:remote_addr}\ |% {USERNAME:remote_user}\ |\ [% {HTTPDATE:time_local}\]\ |% {NOTSPACE:request_ Method}% {NOTSPACE:request} (?: HTTP/% {NUMBER:http_version})\ |% {NUMBER:status}\ |% {NUMBER:upstream_status}\ |% {NUMBER:upstream_response_time}\ |% {NOTSPACE:upstream_addr}\ |% {NUMBER:body_bytes_sent}\ |% {NOTSPACE:request_body}\ |% {NOTSPACE:http_referer}\ |% {GREEDYDATA:http_user_agent}\ |% {NOTSPACE:http_x_forwarded_ Path}\ |% {NOTSPACE:upstream_cache_status} "}} geoip {source = >" remote_addr "target = >" geoip "# Fields to be sent Default is this add_field = > ["[geoip] [coordinates]", "% {[geoip] [longitude]}"] # get longitude add_field = > ["[geoip] [coordinates]", "% {[geoip] [latitude]}"] # get latitude} mutate {convert = > ["[geoip] [coordinates]" "float"] # modify latitude and longitude to float} output {if "nginx_access" in [tags] {elasticsearch {hosts = > ["172.16.100.252 YYYY.MM.dd 9200"] index = > "logstash-nginx_access-% {+ YYYY.MM.dd}" # use the logstash index to avoid manually specifying geoip as the geo_point type. } elasticsearch configuration

Kibana configuration

By default, kibana uses "Elastic Maps Service" display map module. To use modules from other service providers, you can modify "map.tilemap.url". The following is modified to Amap # map.tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'7.4 version of kibana is more compatible with Chinese. Personally, it is recommended to use the default "Elastic Maps Service" display map module of Kibana. You can modify the language of kibana to display Chinese: # i18n.locale: "zh-CN"

Kibana Web configuration

New Visualization-> coordinate Map-> Select logstash Index

Configure according to the following figure and save it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.