ELK如何分析nginx access日志

ELK如何分析nginx access日志，相信很多没有经验的人对此束手无策，为此本文总结了问题出现的原因和解决方法，通过这篇文章希望你能解决这个问题。

注意：修改配置后建议重新创建index

1、nginx 日志文件格式

log_format elk "$http_clientip | $http_x_forwarded_for | $time_local | $request | $status | $body_bytes_sent | " "$request_body | $content_length | $http_referer | $http_user_agent | " "$http_cookie | $remote_addr | $hostname | $upstream_addr | $upstream_response_time | $request_time";

2、logstash nginx 服务器上的配置文件 agent.conf

input {          file {                  type => "elk_frontend_access"                  path => ["/data/logs/flight1-access_log"]          }}  filter {ruby {init => "@kname = ['http_clientip','http_x_forwarded_for','time_local','request','status','body_bytes_sent','request_body','content_length','http_referer','http_user_agent','http_cookie','remote_addr','hostname','upstream_addr','upstream_response_time','request_time']"code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split('|'))])new_event.remove('@timestamp')event.append(new_event)"}if [request] {ruby {init => "@kname = ['method','uri','verb']"code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('request').split(' '))])new_event.remove('@timestamp')event.append(new_event)"}if [uri] {ruby {init => "@kname = ['url_path','url_args']"code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('uri').split('?'))])new_event.remove('@timestamp')event.append(new_event)"}kv {prefix => "url_"source => "url_args"field_split => "& "remove_field => [ "url_args","uri","request" ]}}}mutate {convert => ["body_bytes_sent" , "integer", "content_length", "integer", "upstream_response_time", "float","request_time", "float"]}date {match => [ "time_local", "dd/MMM/yyyy:hh:mm:ss Z" ]locale => "en"}        grok {        match => { "message" => "%{IP:clientip}" }  }        geoip {        source => "clientip"        }}output {        redis {                  host => "10.10.45.200"                  data_type => "list"                  key => "elk_frontend_access:redis"                  port=>"5379"          }  }

3、logstash elk服务器上的配置文件server.conf

input {          redis {                  host => "10.10.45.200"                  data_type => "list"                  key => "elk_frontend_access:redis"                  port =>"5379"          }  }  output {          elasticsearch {                  hosts => "10.10.45.200:8200"                  index => "logstash-zjzc-frontend-%{+YYYY.MM.dd}"          }          stdout {              codec => rubydebug          }  }

注意：如果修改后没有生效，在kibana上重建索引。

看完上述内容，你们掌握ELK如何分析nginx access日志的方法了吗？如果还想学到更多技能或想了解更多相关内容，欢迎关注行业资讯频道，感谢各位的阅读！