Shulou(Shulou.com)06/02 Report--

1. Nginx access log configuration:

1. Log format configuration:

Log_format json'{"@ timestamp": "$time_iso8601",'

'"host": "$server_addr",'

'"clientip": "$remote_addr",'

'"size": $body_bytes_sent,'

'"xff": "$http_x_forwarded_for",'

'"upstreamhost": "$upstream_addr",'

'"status": "$status",'

'"responsetime": $request_time,'

'"upstreamtime": "$upstream_response_time",'

'"http_host": "$host",'

'"url": "$uri"}'

2. Access log configuration:

Access_log syslog:server=xx.xx.xx.xx:5140 json

II. Logstash configuration

Input {

Syslog {

Port = > "5140"

}

}

Filter {

Json {

Source = > "message"

Remove_field = > ["message"]

}

}

Output {

Elasticsearch {hosts = > ['xx.xx.xx.xx:9200','xx.xx.xx.xx:9200']

Index = > 'nginx_rfd-% {+ YYYY.MM.dd.HH}'

Template = > "/ usr/local/logstash/nginx.json"

Template_name = > "nginx_*"

Template_overwrite = > true

}

}

Note that the index name should be included in the template_name

III. Custom mappings

Cat / usr/local/logstash/nginx.json

{

"template": "nginx_*"

"order": 1

"settings": {"index.refresh_interval": "60s"}

"mappings": {

"_ default_": {

"_ all": {"enabled": false}

"properties": {

"@ timestamp": {"type": "date"}

"@ version": {"type": "integer", "index": "not_analyzed"}

"url": {

"type": "string"

"index": "not_analyzed"

}

"host": {

"type": "ip"

"index": "not_analyzed"

}

"clientip": {

"type": "ip"

"index": "not_analyzed"

}

"size": {

"type": "integer"

}

"xff": {

"type": "string"

"index": "not_analyzed"

}

"upstreamhost": {

"type": "string"

"index": "not_analyzed"

}

"http_host": {

"type": "string"

"index": "not_analyzed"

}

"status": {

"type": "integer"

}

"responseTime": {

"type": "string"

"index": "not_analyzed"

}

"upstreamtime": {

"type": "string"

"index": "not_analyzed"

}

}

}

}

}

Fourth, generate statistical graphs

5. Reference documents

Https://elasticsearch.cn/article/154

Http://blog.csdn.net/choelea/article/details/53320140

Http://www.cnblogs.com/hanyifeng/p/5860731.html

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.