Nginx log configuration nginx log is recorded in JSON format

Source: Internet
Author: User
Tags flush json local time syslog nginx reverse proxy

First, let's take a look at nginx log configuration

Logs are advantageous for troubleshooting statistics. This article summarizes nginx log-Related configurations such as access_log, log_format, open_log_file_cache, log_not_found, log_subrequest, rewrite_log, and error_log.
Nginx has a flexible logging mode. Each configuration level can have independent access logs. The log format is defined by the log_format command. Ngx_http_log_module is used to define the request log format.

1. access_log command

Syntax: access_log path [format [buffer = size [flush = time];
Access_log path format gzip [= level] [buffer = size] [flush = time];
Access_log syslog: server = address [, parameter = value] [format];
Access_log off;
Default value: access_log logs/access. log combined;
Configuration segment: http, server, location, if in location, limit_except
Gzip compression level.
Buffer sets the size of the memory cache area.
The maximum time that flush saves in the cache.
No logs: access_log off;
Use the default combined format to record logs: access_log logs/access. log or access_log logs/access. log combined;

2. log_format command

Syntax: log_format name string ...;
Default value: log_format combined "…";
Configuration section: http

Name indicates the format name, and string indicates the equality format. Log_format has a default combined log format, which is equivalent to apache combined log format, as shown below:
Log_format combined '$ remote_addr-$ remote_user [$ time_local]'
'"$ Request" $ status $ body_bytes_sent'
'"$ Http_referer" "$ http_user_agent "';

If nginx is in the server load balancer, squid, and nginx Reverse proxy, the web server cannot directly obtain the real IP address of the client. $ Remote_addr: obtain the IP address of the reverse proxy. The reverse proxy server adds X-Forwarded-For information in the http header of the Forwarded request to record the client IP address and the server address of the client request. PS: For more information about obtaining users' real IP addresses, see http://www.ttlsa.com/html/2235.htmlas shown below:
Log_format porxy '$ http_x_forwarded_for-$ remote_user [$ time_local]'
'"$ Request" $ status $ body_bytes_sent'
'"$ Http_referer" "$ http_user_agent "';

The log format allows the following variable annotations:
$ Remote_addr, $ http_x_forwarded_for record the client IP address
$ Remote_user record the client user name
$ Request records the request URL and HTTP protocol
$ Status records the request status
$ Body_bytes_sent the number of bytes sent to the client, excluding the response header size. This variable is compatible with the "% B" parameter in mod_log_config of the Apache module.
The total number of bytes that $ bytes_sent sends to the client.
The serial number of the $ connection.
$ Connection_requests the number of requests currently obtained through a connection.
$ Msec log write time. The unit is seconds and the precision is millisecond.
$ Pipe if the request is sent through the HTTP pipeline (pipelined), the pipe value is "p", otherwise it is ".".
$ Http_referer records the access from which page link
$ Http_user_agent: Record client browser information
$ Request_length the length of the request (including the request line, request header, and request body ).
$ Request_time: The request processing time, in seconds, in milliseconds. It starts from the first byte of the client until the last character is sent to the client for log writing.
$ Time_iso8601 local time in ISO8601 standard format.
$ Time_local local time in common log format.
[Warning] the response header sent to the client has the "sent_http _" prefix. For example, $ sent_http_content_range. [/Warning]

Example:
Http {
Log_format main '$ remote_addr-$ remote_user [$ time_local] "$ request "'
'"$ Status" $ body_bytes_sent "$ http_referer "'
'"$ Http_user_agent" "$ http_x_forwarded_for "'
'"$ Gzip_ratio" $ request_time $ bytes_sent $ request_length ';
 
Log_format srcache_log '$ remote_addr-$ remote_user [$ time_local] "$ request "'
'"$ Status" $ body_bytes_sent $ request_time $ bytes_sent $ request_length'
'[$ Upstream_response_time] [$ srcache_fetch_status] [$ srcache_store_status] [$ srcache_expire]';
 
Open_log_file_cache max = 1000 inactive = 60 s;
 
Server {
Server_name ~ ^ (Www \.)? (. +) $;
Access_log logs/$ 2-access.log main;
Error_log logs/$ 2-error.log;
 
Location/srcache {
Access_log logs/access-srcache.log srcache_log;
        }
    }
}

3. open_log_file_cache command


Syntax: open_log_file_cache max = N [inactive = time] [min_uses = N] [valid = time];
Open_log_file_cache off;
Default value: open_log_file_cache off;
Configuration section: http, server, location

For each log record, the file is opened first, then the log is written, and then disabled. You can use open_log_file_cache to set the log file cache (off by default). The format is as follows:
The parameter annotations are as follows:
Max: sets the maximum number of file descriptors in the cache. If the cache is full, use the LRU algorithm to disable the descriptor.
Inactive: Set the survival time. The default value is 10 s.
Min_uses: sets the minimum number of log files used in the inactive period. The log file descriptor is recorded in the cache. The default value is 1.
Valid: sets the check frequency. The default value is 60 s.
Off: Disable Cache
Example:
Open_log_file_cache max = 1000 inactive = 20 s valid = 1 m min_uses = 2;

4. log_not_found command

Syntax: log_not_found on | off;
Default value: log_not_found on;
Configuration section: http, server, location
Whether to record non-existent errors in error_log. The default value is.

5. log_subrequest command

Syntax: log_subrequest on | off;
Default value: log_subrequest off;
Configuration section: http, server, location
Whether to record the access log of the sub-request in access_log. No record by default.

6. rewrite_log command

Provided by the ngx_http_rewrite_module module. Used to record the re-write log. We recommend that you enable the rewrite rules for debugging. Nginx rewrite rules guide
Syntax: rewrite_log on | off;
Default value: rewrite_log off;
Configuration section: http, server, location, if
When enabled, the notice-level re-write log is recorded in the error log.

7. error_log command

Syntax: error_log file | stderr | syslog: server = address [, parameter = value] [debug | info | notice | warn | error | crit | alert | emerg];
Default value: error_log logs/error. log error;
Configuration section: main, http, server, location
Configuration error log.



Nginx log is recorded in JSON format

If you want to record nginx logs in json format for logstash analysis, how do you specify the log format? It can be implemented in the following format.

Define the nginx log format:

Log_format logstash_json '{"@ timestamp": "$ time_local ",'
'"@ Fields ":{'
'"Remote_addr": "$ remote_addr ",'
'"Remote_user": "$ remote_user ",'
'"Body_bytes_sent": "$ body_bytes_sent ",'
'"Request_time": "$ request_time ",'
'"Status": "$ status ",'
'"Request": "$ request ",'
'"Request_method": "$ request_method ",'
'"Http_referrer": "$ http_referer ",'
'"Body_bytes_sent": "$ body_bytes_sent ",'
'"Http_x_forwarded_for": "$ http_x_forwarded_for ",'
'"Http_user_agent": "$ http_user_agent "}}';

Specify the log format:
Access_log/data/logs/nginx/www.ttlsa.com. access. log logstash_json;

The log output is as follows:

 

Not conducive to reading. Copy to http://jsonlint.com/beautify the format.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.