nginx 日志
nginx默认的级别
log_format combined '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent"';
log_format
指令中常用的一些变量
$bytes_sent 发送给客户端的总字节数 $body_bytes_sent 发送给客户端的字节数,不包括响应头的大小 $connection 连接序列号 $connection_requests 当前通过连接发出的请求数量 $msec 日志写入时间,单位为秒,精度是毫秒 $pipe 如果请求是通过http流水线发送,则其值为"p",否则为“." $request_length 请求长度(包括请求行,请求头和请求体) $request_time 请求处理时长,单位为秒,精度为毫秒,从读入客户端的第一个字节开始,直到把最后一个字符发送张客户端进行日志写入为止 $status 响应状态码 $time_iso8601 标准格式的本地时间,形如“2017-05-24T18:31:27+08:00” $time_local 通用日志格式下的本地时间,如"24/May/2017:18:31:27 +0800" $http_referer 请求的referer地址。 $http_user_agent 客户端浏览器信息。 $remote_addr 客户端IP $http_x_forwarded_for 当前端有代理服务器时,设置web节点记录客户端地址的配置,此参数生效的前提是代理服务器也要进行相关的x_forwarded_for设置。 $request 完整的原始请求行,如 "GET / HTTP/1.1" $remote_user 客户端用户名称,针对启用了用户认证的请求 $request_uri 完整的请求地址,如 "https://daojia.com/"
json化日志
escape=json 能把body里的16进制直接转成字符串
log_format json escape=json '{ "@timestamp": "$time_iso8601", ' #'"server_host":"$server_addr",''"server_addr":"192.166.208.230",' '"http_host":"$http_host",' '"nginx_version":"$nginx_version",' '"remote_addr":"$remote_addr",' '"remote_user":"$remote_user",' '"request":"$request",' '"request_method":"$request_method",' '"http_user_agent":"$http_user_agent",' '"size":$body_bytes_sent,' '"responsetime":$request_time,' '"upstreamtime":"$upstream_response_time",' '"upstreamhost":"$upstream_addr",' '"url":"$uri",' '"http_x_forwarded_for":"$http_x_forwarded_for",' '"referer":"$http_referer",' '"scheme":"$scheme",' '"server_protocol":"$server_protocol",' '"status":"$status"}';
结果
{ "@timestamp": "2022-01-29T15:37:58+08:00", "server_addr":"192.166.208.111","http_host":"192.166.208.111:8899","nginx_version":"1.18.0","remote_addr":"192.167.14.30","remote_user":"-","request":"POST /platformcmd/index HTTP/1.1","request_method":"POST","http_user_agent":"okhttp/3.8.1","size":53,"responsetime":1.031,"upstreamtime":"1.031","upstreamhost":"127.0.0.1:12300","url":"/platform/index","http_x_forwarded_for":"-","referer":"-","scheme":"http","server_protocol":"HTTP/1.1","status":"200"}
获得请求体
日志分割每天一个文件