ELK收集NGINX日志

server 192.168.88.8(elasticsearch logstash)
server 192.168.88.17 (kibana httpd-tools)
可视化图常用命令参考

nginx(192.168.88.8)

yum -y install epel-release
yum -y install nginx

正则

cd /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns
vim nginx_access

URIPARAM1 [A-Za-z0-9$.+!’|(){},[email protected]#%&/=:;_?-[]]
NGINXACCESS %{IPORHOST:client_ip} (%{USER:ident}|- )
(%{USER:auth}|-) [%{HTTPDATE:timestamp}] “(?:%{WORD:verb}
(%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)”
%{NUMBER:status} (?:%{NUMBER:bytes}|-) “(?:%{URI:referrer}|-)”
“%{GREEDYDATA:agent}”
添加logstash的nginx 日志收集配置文件
logstash grok 内置正则：https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

logstash

vim /etc/logstash/conf.d/nginx.conf
ELK收集NGINX日志
chmod -R 777 /var/log/nginx/access.log
vim pipelines.yml

systemctl restart logstash
tailf /var/log/logstash/logstash-plain.log

httpd-tools(192.168.88.17)

ab -n 100 -c 100 http://192.168.88.8/index.html
ELK收集NGINX日志
查看索引 curl -X GET http://192.168.88.8:9200/_cat/indices?v