logstash收集Nginx日志，转换为JSON格式

Nginx日志处理为JSON格式，并放置在http区块：

log_format json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":"$body_bytes_sent",'
'"responsentime":"$request_time",'
'"referer":"$http_referer",'
'"useragent":"$http_user_agent"'
'}';
access_log logs/access_json.log json;

Nginx日志格式　　

 

 

logstash配置文件：

 

input {
file {
path =>"/usr/local/nginx/logs/access_json.log"
codec =>"json"
start_position => "beginning"

}
}

filter{
json {
source => "message"
skip_on_invalid_json => true
}
}
output{

elasticsearch {
hosts =>["172.16.3.160:9200"]
index => "logstash-zabbix-nginx-log-%{+YYYY.MM.dd}"

}
}

logstash配置文件