将nginx access.log改成json格式

 

为了便于使用和分析，有时候需要把nginx的日志定义为json格式，特别是在使用logstash的时候，json化的日志相当直观。

具体配置方法：

1、打开nginx.conf配置文件

找到nginx安装目录下的nginx.conf文件

 vim /etc/nginx/nginx.conf

在http模块中将nginx日志格式定义为json格式

log_format json '{"@timestamp":"$time_iso8601",'

                      '"@source":"$server_addr",'

                      '"remote_addr":"$remote_addr",'

                      '"remote_user":"$remote_user",'

                      '"body_bytes_sent":"$body_bytes_sent",'

                      '"request_time":"$request_time",'

                      '"status":"$status",'

                      '"host":"$host",'

                      '"uri":"$uri",'

                      '"server":"$server_name",'

                      '"port":"$server_port",'

                      '"protocol":"$server_protocol",'

                      '"request_uri":"$request_uri",'

                      '"request_body":"$request_body",'

                      '"request_method":"$request_method",'

                      '"http_referrer":"$http_referer",'

                      '"body_bytes_sent":"$body_bytes_sent",'

                      '"http_x_forwarded_for":"$http_x_forwarded_for",'

                      '"http_user_agent":"$http_user_agent",'

                      '"upstream_response_time":"$upstream_response_time",'

                      '"upstream_addr":"$upstream_addr"}';

编辑好json格式之后定义日志储存（注:需要注释掉原来的日志储存）

access_log /var/log/nginx/access_json.log json;

重新加载nginx

nginx -s reload

这样在调用之后access日志便变为了json格式

cd /var/log/nginx

此时通过浏览器或者curl访问nginx服务，可看到生成的日志内容是json格式的

{

"@timestamp": "2019-06-25T14:22:49+08:00",

"host": "192.168.1.82",

"clientip": "192.168.1.40",

"size": 1225,

"responsetime": 0.000,

"upstreamtime ": " - ",

"upstreamhost ": " - ",

"http_host ": "192.168 .1 .82 ",

"url ": " / statics / images /icon / rsso.gif ",

"referer ": "http: //192.168.1.82/statics/css/default_blue.css",

"agent": "Mozilla/5.0 (Windows NT 10.0;Win64;x64;rv: 67.0) Gecko / 20100101 Firefox / 67.0 ",

"status ": "200 "

}