elk nginx

一 ：客戶端logstash.conf配置文件

input {
   file {
       path => "/usr/local/nginx/logs/access.log"
       type => "nginxlog"
       start_position => "beginning"
     # sincedb_path => "/home/logstash/sincdb.nginxlog"
       }
}

filter{
    if [type]=="nginxlog" {
     grok {
       match => ["message", "%{COMMONAPACHELOG}"]
       }
     date {
       match => ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
    }
 }
}

output {
    stdout { codec => rubydebug }
    elasticsearch { hosts => "elk.test.com:9200" }
}
 

########################################################下面是kibana上面顯示的日誌內容
"request" => "/",
"auth" => "-",
"ident" => "-",
"verb" => "GET",
"message" => "192.168.216.1 - - [22/Nov/2017:16:28:41 +0800] \"GET / HTTP/1.1\" 499 0 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\"",

"type" => "nginxlog",
"path" => "/usr/local/nginx/logs/access.log",
"@timestamp" => 2017-11-22T08:28:41.000Z,
"response" => "499",
"bytes" => "0",
"clientip" => "192.168.216.1",
"@version" => "1",
"host" => "nginx.test.com",
"httpversion" => "1.1",
"timestamp" => "22/Nov/2017:16:28:41 +0800"

二 添加圖像
1查看ip訪問次數

2添加訪問網站返回狀態碼的次數

3 添加訪問網站路徑的次數，這個選擇的是Data table類型

4 添加統計網站各個時間段的請求響應傳輸量分布選擇的，Area chart類型

5 統計各個日誌路徑的數目（系統上面所有日誌的路徑）

三 保存dasbord，把上面的五個圖可以同時顯示在一個頁面之上

1 第一步添加完成之後，就會跳到第二部，保存即可。

elk收集nginx日誌