Nginx自定义Json日志格式
为配合ELK，EFK使用，需要将web日志格式设置为Json格式。
#vim /apps/nginx-1.18.0/conf/nginx.conf
#添加如下json格式
log_format access_json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr",'
'"http_host":"$host",'
'"uri":"$uri",'
'"xff":"$http_x_forwarded_for",'
'"referer":"$http_referer",'
'"tcp_xff":"$proxy_protocol_addr",'
'"http_user_agent":"$http_user_agent",'
'"status":"$status"}';
access_log logs/access_json.log access_json;
#nginx -s reload
输出日志
#tail -f access_json.log
{"@timestamp":"2022-03-16T15:18:56+08:00","host":"10.0.0.117","clientip":"10.0.0.127","size":15,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"10.0.0.117","uri":"/index.html","xff":"-","referer":"-","tcp_xff":"-","http_user_agent":"curl/7.29.0","status":"200"}
{"@timestamp":"2022-03-16T15:18:56+08:00","host":"10.0.0.117","clientip":"10.0.0.127","size":15,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"10.0.0.117","uri":"/index.html","xff":"-","referer":"-","tcp_xff":"-","http_user_agent":"curl/7.29.0","status":"200"}
{"@timestamp":"2022-03-16T15:18:56+08:00","host":"10.0.0.117","clientip":"10.0.0.127","size":15,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"10.0.0.117","uri":"/index.html","xff":"-","referer":"-","tcp_xff":"-","http_user_agent":"curl/7.29.0","status":"200"}
{"@timestamp":"2022-03-16T15:18:56+08:00","host":"10.0.0.117","clientip":"10.0.0.127","size":15,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"10.0.0.117","uri":"/index.html","xff":"-","referer":"-","tcp_xff":"-","http_user_agent":"curl/7.29.0","status":"200"}
{"@timestamp":"2022-03-16T15:18:56+08:00","host":"10.0.0.117","clientip":"10.0.0.127","size":15,"responsetime":0.000,"upstreamtime":"-","upstreamhost":"-","http_host":"10.0.0.117","uri":"/index.html","xff":"-","referer":"-","tcp_xff":"-","http_user_agent":"curl/7.29.0","status":"200"}
验证json格式是否正确
推荐使用在线Json格式验证
https://www.json.cn/
