ELK 监控nginx日志

环境：

192.168.253.110 elasticsearch & kinana

192.168.253.120 logstash

1.在logstash服务器上操作：

[[email protected] ~]# cd /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/
#将创建好的nginx文件上传至这个目录下

[[email protected] patterns]# vim nginx
NGINX %{IPORHOST:client_ip} (%{USER:ident}|- ) (%{USER:auth}|-) \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)" %{NUMBER:status} (?:%{NUMBER:bytes}|-) "(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}"

logstash grok 内置正则：https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

2.添加logstash的nginx日志收集配置文件

[[email protected] ~]# cd /etc/logstash/conf.d/
[[email protected] conf.d]# vim nginx.conf

input {
file {
path => "/usr/local/nginx/logs/access.log"
type => "nginx-log"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "%{NGINX}" }
}

}
output {
elasticsearch {
hosts => "192.168.253.110:9200"
index => "nginx_log-%{+YYYY.MM.dd}"
}
}

注意：如果log放在/var/log下记得给权限 chmod 777 /var/log -R