1.配置nginx日志

編輯nginx.conf文件 vim /etc/nginx/nginx.conf 在http節(jié)點下配置如下

log_format json '{"@timestamp":"$time_iso8601",'
                           '"@version":"1",'
                           '"client":"$remote_addr",'
                           '"url":"$uri",'
                           '"status":"$status",'
                           '"domain":"$host",'
                           '"host":"$server_addr",'
                           '"size":$body_bytes_sent,'
                           '"responsetime":$request_time,'
                           '"referer": "$http_referer",'
                           '"ua": "$http_user_agent"'
               '}';
    access_log /data/nginx/logs/access_json.log json;

目的就是將nginx的日志以json的形式進行文件存儲，方便es存儲
訪問nginx 查看日志 tail -f /data/nginx/logs/access_json.log 可以看到新的入職信息說明配置正常

安裝elk

采用docker-compose

version: "3"
services:
  elasticsearch:
    image: "elasticsearch:7.1.1"
    container_name: "elasticsearch"
    restart: "always"
    volumes:
      - "elasticsearch:/usr/share/elasticsearch"
    #vim /etc/sysctl.conf
    #vm.max_map_count=262144
    #sysctl -w vm.max_map_count=262144
    #sysctl -p
    environment:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - discovery.type=single-node
    networks:
      - "elk"
    ports:
      - "9200:9200"
      - "9300:9300"
  kibana:
    image: "kibana:7.1.1"
    container_name: "kibana"
    restart: "always"
    depends_on:
      - elasticsearch
    volumes:
      - "kibana:/usr/share/kibana"
    networks:
      - "elk"
    ports:
      - "5601:5601"


  logstash:
    image: "logstash:7.1.1"
    container_name: "logstash"
    restart: "always"
    networks:
      - "elk"
    ports:
      - "5044:5044"
      - "9600:9600"
    volumes:
      - "logstash:/usr/share/logstash"
      - "/data/nginx/logs:/data/nginx/logs"  

networks:
  elk:

volumes:
  elasticsearch:
  logstash:
  kibana:

配置

• 配置logstash.yml
  在config/logstash.yml文件下追加

path.config: /usr/share/logstash/conf.d/*.conf

• 配置logstash日志處理文件
  新增conf.d/logstash.conf文件 內(nèi)容如下：

input {
   file {
        type => "nginx-access-log"
        path => "/data/nginx/logs/access_json.log"
        start_position => "beginning"
        stat_interval => "2"
        codec => json
   }

}
filter {}
output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    index => "logstash-nginx-access-log-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
  stdout {
        codec => json_lines
  }
}

說明：

• start_position 指從文件開始位置讀取
• stat_interval 指每間隔兩秒讀取一次
• index 指定索引名稱
• user | password 這里沒有安裝xpack插件，所以用戶名，密碼不用配置，如果需要可以 自行配置
  啟動docker-compose
docker -compose up -d --build
  之后打開head插件發(fā)現(xiàn)發(fā)出來一個index庫
  

打開http:{host}:5601在kibana中添加nginx日志匹配規(guī)則