ELK学习笔记之ELK分析nginx日志

ELK学习笔记之ELK分析nginx日志

0x00 配置FIlebeat搜集syslog

#安装rpm -ivh filebeat-6.2.3-x86_64.rpmmv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.bak #配置vim /etc/filebeat/filebeat.ymlfilebeat.prospectors:- type: log enabled: true paths: - /usr/local/nginx/logs/access.log fields: log_topics: nginx-1.197 max_bytes: 1048576 output.logstash: hosts: ["192.168.1.202:5044"] #启动/etc/init.d/filebeat start

0x01 配置Logstash从filebeat输入syslog日志

vim /etc/logstash/conf.d/nginx.confinput { beats { port => 5044 }} output { if[fields][log_topics] == "nginx-1.197" { elasticsearch { hosts => ["192.168.1.202:9200"] index => "nginx-1.197-%{+YYYY.MM}" } }}

0x02 查看索引

curl health status index uuid pri rep docs.count docs.deleted store.size pri.store.sizegreen open .kibana sdsMVkoKQZaZncZf6OXEeg 1 0 2 0 7.4kb 7.4kbyellow open nginx-1.197-2018.03 QfyT76TDQEqUD31wRmoddg 5 1 0 0 460b 460b

0x03 创建索引

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。