用efk收集nginx日志
1.解压filebeats。
[root@localhost ~] tar xzf filebeat-7.8.0-linux-x86_64.tar.gz -C /usr/local/
[root@localhost ~] yum -y install epel*;yum -y install nginx
[root@localhost ~] cd /usr/local
[root@localhost ~] mv filebeat-7.8.0-linux-x86_64/ filebeat
[root@localhost ~] cd filebeat/
[root@localhost ~] mv filebeat.yml filebeat.yml.bak
[root@localhost ~] vim filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/*.log
output:
elasticsearch:
hosts: ["10.8.156.70:9200"]
indices:
- index: "nginx-%{+YYYY.MM.dd}"
然后去修改nginx的配置文件
[root@localhost ~] vim /etc/nginx/nginx.conf
http {
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log /var/log/nginx/access.log main;
log_format json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"referer": "$http_referer",'
'"ua": "$http_user_agent"'
'}';
access_log /var/log/nginx/access_json.log json;
最后去启动nginx和filebeats
[root@localhost ~] nohup ./filebeat -e -c filebeat.yml &
image.png
