filebeat+logstash收集nginx日志

1.nginx配置

(1)编辑nginx.conf

 http {#其他配置...#需要添加的内容log_format json '{"@timestamp":"$time_iso8601",''"host":"$server_addr",'' "clientip" : "$remote_addr",'' "size" : "$body_bytes_sent" ,''"respnsetime":"$request_time",''"upstremtime":"$upstream_response_time",''"upstremhost":"$upstream_addr",''"httphost":"$host",''"referer":"$http_referer",''"xff":"$http_x_forwarded_for",''"agent":"$http_user_agent",''"clientip":"$remote_addr",''"request":"$request",''"uri":"$uri",''"status":"$status"}';#需要修改的内容，json对应上面定义的格式名access_log  /usr/local/nginx/logs/access.log  json;#其他配置...
}

(2)重启nginx（必须）

2.配置filebeat

注意：filebeat必须和nginx在同一台主机上
filebeat.yml——修改两个地方：input和output

filebeat.inputs:
- type: logenabled: truepaths: - /usr/local/nginx/logs/access.logtags: ["nginx-log"]json.keys_under_root: truejson.overwrite_keys: true#这里ip地址和端口填安装logstash的主机ip和对应logstash开放端口
output.logstash:hosts: ["xxx.xxx.xxx.xxx:5044"]

3.配置logstash

编辑 logstash.conf

input {beats {port => 5044}
}output {elasticsearch {#es服务段地址hosts => ["http://xxx.xxx.xxx.xxx:9200"]# 索引名称index => "nginx-%{+YYYY.MM.dd}"}#控制台打印，便于调试和观察stdout { codec => rubydebug }
}

4.展示

logstash控制台日志：

索引简历成功：