一、将nginx访问日志转化为json格式
1、修改nginx的配置文件nginx.conf
log_format json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":"$body_bytes_sent",'
'"responsentime":"$request_time",'
'"referer":"$http_referer",'
'"useragent":"$http_user_agent",'
'"upstreampstatus":"$upstream_status",'
'"upstreamaddr":"$upstream_addr",'
'"upstreamresponsetime":"$upstream_response_time"'
'}';
access_log logs/access_json.log json;
#将以上内容添加到nginx配置文件的http区块
2、输入的日志格式如下:
{"@timestamp":"2018-08-18T00:44:07+08:00","@version":"1","client":"192.168.1.X","url":"-","status":"400","domain":"localhost","host":"192.168.1.x","size":"166","responsentime":"0.286","referer":"-","useragent":"-","upstreampstatus":"-","upstreamaddr":"-","upstreamresponsetime":"-"}
{"@timestamp":"2018-08-18T22:02:29+08:00","@version":"1","client":"192.168.1.x","url":"-","status":"400","domain":"localhost","host":"192.168.1.x","size":"166","responsentime":"0.205","referer":"-","useragent":"-","upstreampstatus":"-","upstreamaddr":"-","upstreamresponsetime":"-"}
{"@timestamp":"2018-08-18T22:02:29+08:00","@version":"1","client":"192.168.1.x","url":"-","status":"400","domain":"localhost","host":"192.168.1.x","size":"166","responsentime":"0.218","referer":"-","useragent":"-","upstreampstatus":"-","upstreamaddr":"-","upstreamresponsetime":"-"}
3、输出的json格式为:
{
"@timestamp": "2018-08-18T22:02:29+08:00",
"@version": "1",
"client": "192.168.1.x",
"url": "-",
"status": "400",
"domain": "localhost",
"host": "192.168.1.x",
"size": "166",
"responsentime": "0.218",
"referer": "-",
"useragent": "-",
"upstreampstatus": "-",
"upstreamaddr": "-",
"upstreamresponsetime": "-"
}