日志格式：
log_format usgateway '$http_clientip\t$http_ServiceName\t$http_uid\t$http_sid\t[$time_local]'
                                     '\t$request\t$status\t$body_bytes_sent\t$connection_requests'
                                     '\t$remote_addr\t$http_referer\t$http_user_agent'
                                     '\t$request_body\t$request_time\t$msec';
日志實(shí)例：
10.10.45.152---[23/Jun/2017:17:37:42 +0800]POST /sg HTTP/1.14055765910.10.130.100-Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0){\x22mbrNetName\x22:\x22\xE9\x87\x91\xE6\x98\x9F\x22,\x22nameCn\x22:\x22\xE8\x8A\x92\xE6\x9E\x9C\xE7\xBD\x91\x22,\x22gender\x22:\x2211\x22,\x22birthday\x22:\x222010-10-01\x22,\x22mbrId\x22:\x2235954629\x22,\x22emailAddr\x22:\x22334740263@qq.com\x22,\x22mobileNo\x22:\x2215902074059\x22}0.0011498210662.427
logstash配置文件：
input {  
        file {  
                type => "uSG_gateway_access"  
                path => ["/usr/local/elk/elklog/nginxlog/log0/uSG_gateway_elk.log"]  
        }
} 
filter {
ruby {
init => "@kname = ['http_clientip','http_ServiceName','http_uid','http_sid','time_local','request','status','body_bytes_sent','connection_requests','remote_addr','http_referer','http_user_agent','request_body','request_time','msec']"
code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split(''))])
new_event.remove('@timestamp')
event.append(new_event)"
}
if [request] {
ruby {
init => "@kname = ['method','uri','verb']"
code => "new_event = LogStash::Event.new(Hash[@kname.zip(event.get('request').split(' '))])
new_event.remove('@timestamp')
event.append(new_event)
"
}
}
mutate {
convert => ["body_bytes_sent" , "integer", "content_length", "integer", "upstream_response_time", "float","request_time", "float"]
}
        grok {
match => [ "message", "%{IPORHOST:clientip}%{USER}%{USER}%{USER}\[%{HTTPDATE:timestamp}\]"]
}
date {
match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
locale => "en"
}
        geoip {
source => "clientip"
    }
useragent {
    source => "http_user_agent"
    target => "useragent"
  }
}
output { 
elasticsearch {
hosts => "10.10.45.200:8201"
        index => "logstash-gateway-frontend-%{+YYYY.MM.dd}"
}
}
注意：日志分隔符為table鍵。

名稱欄目：nginx訪問日志logstash配置文件實(shí)例1
文章URL：http://aaarwkj.com/article32/jeegpc.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供網(wǎng)頁設(shè)計(jì)公司、小程序開發(fā)、做網(wǎng)站、ChatGPT、全網(wǎng)營(yíng)銷推廣、網(wǎng)站策劃

廣告

聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請(qǐng)盡快告知，我們將會(huì)在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng)，如需處理請(qǐng)聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時(shí)需注明來源： 創(chuàng)新互聯(lián)