大叔经验分享（28）ELK分析nginx日志

提前安装好elk（elasticsearch、logstach、kibana）

一 启动logstash

$LOGSTASH_HOME默认位于/usr/share/logstash或/opt/logstash

1 nginx日志使用默认格式

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

                      '$status $body_bytes_sent "$http_referer" '

                      '"$http_user_agent" "$http_x_forwarded_for"';

2 下载geo库

# cd /etc/logstash
# wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz
# tar xvf GeoLite2-City.tar.gz

3 增加logstash配置

# cat /etc/logstash/conf.d/nginx_access.conf

input {

    file {

        path => [ "/path/to/nginx/access.log" ]

        start_position => "beginning"

        ignore_older => 0

    }

}

filter {

    grok {

        match => { "message" => "%{IPORHOST:client_ip} (%{USER:ident}|-) (%{USER:auth}|-) \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)\" (%{NUMBER:response}|-) (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}" }

    }

    geoip {

      source => "client_ip"

      target => "geoip"

      database => "/etc/logstash/GeoLite2-City_20190122/GeoLite2-City.mmdb"

      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]

      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]

    }

    mutate {

      convert => [ "[geoip][coordinates]", "float" ]

      convert => [ "response","integer" ]

      convert => [ "bytes","integer" ]

      replace => { "type" => "nginx_access" }

      remove_field => "message"

    }

    date {

      match => [ "timestamp","dd/MMM/yyyy:HH:mm:ss Z"]

    }

    mutate {

      remove_field => "timestamp"

    }

}

output {

    elasticsearch {

        hosts => ["$es_server:9200"]

        index => "logstash-nginx-access-%{+YYYY.MM.dd}"

    }

    stdout {codec => rubydebug}

}

修改其中的nginx日志路径以及es的host；

如果你修改过nginx log format，还需要修改grok格式，grok格式可以在这里调试：http://grokdebug.herokuapp.com/

如果格式有误，会报 _grokparsefailure

4 测试配置是否正常

$LOGSTASH_HOME/bin/logstash -t -f /etc/logstash/conf.d/nginx_access.conf

正常应该会打印Configuration OK

5 启动logstash

$LOGSTASH_HOME/bin/logstash -f /etc/logstash/conf.d/nginx_access.conf

二 查看elasticsearch

# curl http://$es_server:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open logstash-nginx-access-2019.01.26 -szaQCE3THyq-fXbU18riQ 5 1 7875 0 862.7kb 465.2kb

此时es中应该有了索引

三 配置kibana

浏览器打开：http://$kibana_server:5000

配置索引pattern为：logstash-nginx-access-*
配置Time-field为：@timestamp

然后可以配置各种visualization和dashboard