Elk nginx Log output using JSON format

JSON nginx default log output format is text non-JSON format, modify the configuration file can output JSON format for easy collection and drawing

Modify Nginx configuration file to add configuration, adding a JSON output format to the log format

Log_format Access_log_json ' {"user_ip": "$http _x_forwarded_for", "lan_ip": "$remote _addr", "Log_time": "$time _iso8601 "," USER_RQP ":" $request "," Http_code ":" $status "," body_bytes_sent ":" $body _bytes_sent "," Req_time ":" $request _time ", "User_ua": "$http _user_agent"};

The log output format is

Configure the Logstash file to see the results before standard output

input{    file{        path = "/data/logs/nginx/http-access.log"        codec = "JSON"}}filter{}output{    stdout{        codec =>rubydebug    }}~                                                                                           ~                                 

Start/usr/share/logstash/bin/logstash-f nginx.conf

Web page access nginx view output, output in JSON format

And then output it to Elasticsearch.

　

Elk nginx Log output using JSON format