Docker之ELK收集分析nginx日志

nginx改成json格式输出日志

1、http段加如下信息

 log_format json '{ "@timestamp": "$time_local", '
         '"@fields": { '
         '"remote_addr": "$remote_addr", '
         '"remote_user": "$remote_user", '
         '"body_bytes_sent": "$body_bytes_sent", '
         '"request_time": "$request_time", '
         '"status": "$status", '
         '"request": "$request", '
         '"request_method": "$request_method", '
         '"http_referrer": "$http_referer", '
         '"body_bytes_sent":"$body_bytes_sent", '
         '"http_x_forwarded_for": "$http_x_forwarded_for", '
         '"http_user_agent": "$http_user_agent" } }';
    access_log  /var/log/nginx/access_json.log  json;

2、编写收集Nginx访问日志

[zhuxiaoshuai@web conf.d]# vim nginx.conf

input {

    file {
        type => "access_nginx"
        path => "/var/log/nginx/access_json.log"
        codec => "json"
        }
}

output {
    redis {
        host => "203.0.113.112"
        port => "6379"
        db => "6"
        data_type => "list"
        key => "access_nginx"
        }
}