napfish
2017-03-27 15:36有关ELK logstash nginx日志问题?
打扰各位
Mar 27 23:23:42 192.168.0.96 {"@timestamp": "2017-03-27T23:23:42+08:00","host":"192.168.0.95","clientip":"36.149.14.104","size":420,"responsetime":0.021,"upstreamtime":"0.021","upstreamhost":"192.168.0.209:80","http_host":"www.test.com","url":"/assistant/ass/im/friendinfo.json","xff":"-","referer":"-","agent":"/5.0.7 te; iOS 10.2.1; Scal
e/2.00)","status":"200"}
这是我通过Rsyslog把nginx json日志打到ELK的log。
NGINX配置如下:
logformat json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"host":"$server_addr",'
'"client":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"domain":"$host",'
'"url":"$uri",'
'"status":"$status"}';
access_log /var/log/nginx/access.log_json json;
然后logstash 配置:
filter {
json {
source => "message"
target => "jsoncontent"
}
}
按道理能output出message的格式化字段啊,为什么我依旧是输出整条message?
- 点赞
- 回答
- 收藏
- 复制链接分享
2条回答
为你推荐
- 求大牛指点,hadoop 副本数大于节点数时,副本是怎么存放的?
- java
- scala
- 1个回答
- flex 4:HTTP请求不发送值
- httprequest
- php
- 1个回答
- 在下拉菜单中选择了Echo
- html
- php
- 1个回答
- 当我选择许多图像时,Php多图像上传失败
- file-upload
- php
- 2个回答
- CodeIgniter电子邮件发送问题
- codeigniter
- php
- 1个回答
换一换