ELK 监控nginx日志_elk 监控 nginx

作者：菜鸟追梦旅行 | 2024-03-27 02:00:15

踩

elk 监控 nginx

环境：

192.168.253.110 elasticsearch & kinana

192.168.253.120 logstash

ntpdate pool.ntp.org 同步两边时间

1.在logstash服务器上操作：

[root@localhost ~]# cd /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns/
#将创建好的nginx文件上传至这个目录下

[root@localhost patterns]# vim nginx


NGINXACCESS %{IPORHOST:client_ip} (%{USER:ident}|- ) (%{USER:auth}|-) \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)" %{NUMBER:status} (?:%{NUMBER:bytes}|-) "(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}"

logstash grok 内置正则：https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

2.添加logstash的nginx日志收集配置文件

[root@localhost ~]# cd /etc/logstash/conf.d/
[root@localhost conf.d]# vim nginx.conf

input {
file {
path => "/usr/local/nginx/logs/access.log"
type => "nginx-log"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "%{NGINXACCESS}" }
}

}
output {
elasticsearch {
hosts => "192.168.253.110:9200"
index => "nginx_log-%{+YYYY.MM.dd}"
}
}

注意：如果log放在/var/log下记得给权限 chmod 777 /var/log -R