1.修改nginx日誌格式
vim /datas/soft/nginx/conf/nginx.conf
將預設日誌這段給註釋掉
改成json格式的

log_format json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr
 
",'
'"http_host":"$host",'
'"url":"$uri",'
'"referer":"$http_referer",'
'"agent":"$http_user_agent",'
'"status":"$status"}';

access_log /var/log/nginx/access_json.log json;

nginx -s reload

測試檔案：

[root@node1 logstash-6.4.0]# vim config/file.conf 

input {
    file {
         path => "/var/log/nginx/access.log"
 

         codec => json
         start_position => "beginning"
         }
}

output {
    stdout {
     codec  => rubydebug
   }
}

[[email protected] logstash-6.4.0]# ./bin/logstash -f config/file.conf 
...
....
{
    "upstreamtime" => "-",
         "referer" => "-",
        "clientip"
 
 => "192.168.10.1",
             "url" => "/index.html",
           "agent" => "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36",
      "@timestamp" => 2018-09-03T07:29:29.000Z,
            "path" => "/var/log/nginx/access.log",
    "upstreamhost" => "-",
        "@version" => "1",
    "responsetime" => 0.0,
       "http_host" => "192.168.10.14",
          "status" => "304",
            "host" => "192.168.10.14",
            "size" => 0
}
...
....

檢視下訪問日誌，發現變成JSON格式了
寫入elasticsearch中

input { 
  file {
    path => "/var/log/nginx/access.log"
    codec => json
    type  =>  "ngxin-log" 
    start_position  => "beginning"
  }

}

output {
if [type] == "nginx-log"{
 elasticsearch {
  hosts => ["192.168.56.11:9200"]
  index => "nginx-log-%{+YYYY.MM.dd}"
}  
}