logstash grok切分nginx日志

日志类型

map $http_x_forwarded_for $clientRealIp {
"" $remote_addr;
~^(?P<firstAddr>[0-9\.]+),?.*$ $firstAddr;
}

log_format  proxy_main  '$clientRealIp "$http_x_forwarded_for" $remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" $request_time $upstream_response_time '
                        '$proxy_host $upstream_addr';

日志格式

120.92.12.137 "1.1.1.1, 2.2.2.2" 120.92.12.137 - - [10/Jul/2019:03:38:16 +0000] "GET /api HTTP/1.1" 406 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.3 skyeye-scanner" 0.105 0.104 127.0.0.1:8080 127.0.0.1:8080

 

切分格式

(?<clientRealIp>%{IP}|-) \"(?<http_x_forwarded_for>([0-9., ]+|-))\"\s(?<remote_addr>%{IP}|-)\s-\s%{NOTSPACE:remote_user} \[%{HTTPDATE:time_local}\] \"%{WORD:method} (?<request_uri>(.*)) HTTP/%{NUMBER:http_version}\" %{NUMBER:status} (?:%{NUMBER:body_bytes}|-) \"%{NOTSPACE:http_referer}\" %{QS:agent} %{NUMBER:request_time} %{NUMBER:upstream_response_time} (?:%{HOSTPORT:proxy_host}|-) (?:%{HOSTPORT:upstream_addr}|-)