elk收集nginx日志

心已赠人 2023-10-18 11:58 75阅读 0赞

一 ：客户端logstash.conf配置文件

input {
       file {
           path => "/usr/local/nginx/logs/access.log"
           type => "nginxlog"
           start_position => "beginning"
         # sincedb_path => "/home/logstash/sincdb.nginxlog"
           }
    }
    
    filter{
        if [type]=="nginxlog" {
         grok {
           match => ["message", "%{COMMONAPACHELOG}"]
           }
         date {
           match => ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
        }
     }
    }
    
    output {
        stdout { codec => rubydebug }
        elasticsearch { hosts => "elk.test.com:9200" }
    }

\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#下面是kibana上面显示的日志内容  
"request" => "/",  
"auth" => "-",  
"ident" => "-",  
"verb" => "GET",  
"message" => "192.168.216.1 - - \[22/Nov/2017:16:28:41 +0800\] \\"GET / HTTP/1.1\\" 499 0 \\"-\\" \\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\\"",  
"type" => "nginxlog",  
"path" => "/usr/local/nginx/logs/access.log",  
"@timestamp" => 2017-11-22T08:28:41.000Z,  
"response" => "499",  
"bytes" => "0",  
"clientip" => "192.168.216.1",  
"@version" => "1",  
"host" => "nginx.test.com",  
"httpversion" => "1.1",  
"timestamp" => "22/Nov/2017:16:28:41 +0800"

二 添加图像  
1查看ip访问次数

![elk收集nginx日志][elk_nginx]

2添加访问网站返回状态码的次数

![elk收集nginx日志][elk_nginx 1]

3 添加访问网站路径的次数，这个选择的是Data table类型

![elk收集nginx日志][elk_nginx 2]

4 添加统计网站各个时间段的请求响应传输量分布选择的，Area chart类型  
![elk收集nginx日志][elk_nginx 3]

5 统计各个日志路径的数目（系统上面所有日志的路径）  
![elk收集nginx日志][elk_nginx 4]  
![elk收集nginx日志][elk_nginx 5]

三 保存dasbord，把上面的五个图可以同时显示在一个页面之上

1 第一步添加完成之后，就会跳到第二部，保存即可。  
![elk收集nginx日志][elk_nginx 6]

![elk收集nginx日志][elk_nginx 7]

来源:[http://blog.51cto.com/825536458/2084486][http_blog.51cto.com_825536458_2084486]

[elk_nginx]: http://i2.51cto.com/images/blog/201803/09/4414042b31f2b032b70969a83033be21.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 1]: http://i2.51cto.com/images/blog/201803/09/378c32746748d8c6a996b7b5f1ce7a4d.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 2]: http://i2.51cto.com/images/blog/201803/09/05470403ed2939b38c59154ada6d09a7.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 3]: http://i2.51cto.com/images/blog/201803/09/e228d09f339d532c12f957477692fd63.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 4]: http://i2.51cto.com/images/blog/201803/09/58f98cfd0ff1a44c704cf320dab76c3f.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 5]: http://i2.51cto.com/images/blog/201803/09/deead003553e57177a7c8f0f8f5f3af4.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 6]: http://i2.51cto.com/images/blog/201803/09/a2e6bb97023843258c6e504c793f23ae.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[elk_nginx 7]: http://i2.51cto.com/images/blog/201803/09/a7de1ae7bfbd2d274ba7c5a2709bf5d5.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[http_blog.51cto.com_825536458_2084486]: http://blog.51cto.com/825536458/2084486