## 收集 Nginx 业务日志 [toc] ### 1 Nginx json 日志格式定义 ```sh [root@zhimai-web01 ~]# vim /etc/nginx/nginx.conf ...... log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; log_format main_json '{"@timestamp":"$time_local",' '"N_client_ip": "$remote_addr",' '"N_request": "$request",' '"N_request_time": "$request_time",' '"N_status": "$status",' '"N_bytes": "$body_bytes_sent",' '"N_user_agent": "$http_user_agent",' '"N_x_forwarded": "$http_x_forwarded_for",' '"N_referer": "$http_referer"' '}'; ...... ``` ### 2 filebeat 多日志收集 ```sh filebeat.inputs: - type: log enabled: true paths: - /var/log/nginx/access.log tags: ["web","zhimai-nginx"] json.keys_under_root: true json.overwrite_keys: true output.redis: hosts: ["172.17.19.xx"] port: 6789 password : 'xxxxxxxx' key: "filebeat-1916" db: 1 timeout: 5 ```