ELK——FileBeat配置ngnix log改为解析Json

FileBeat的版本为7.3.2，版本不同添加的参数不同！！！

第一步：改Ngnix
编辑ngnix.conf文件，在http模块下如下添加

http {

  include       mime.types;
    default_type  application/octet-stream;
	
	#这里是默认给的示例
    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    #z这里默认的是main
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                                          '$http_host '
                      ' $upstream_response_time  $request_time  $upstream_addr ';
     #在此处添加                 
    log_format  log_json  '{"@timestamp": "$time_local","user_ip":"$http_x_real_ip","lan_ip":"$remote_addr","log_time":"$time_iso8601","user_req":"$request","http_code":"$status","body_bytes_sents":"$body_bytes_sent","req_time":"$request_time","user_ua":"$http_user_agent"}';
    
     #最后指定log文件输出的类型为上方添加的log_json
     access_log  /var/log/nginx/access.log  log_json;

#下面的http模块的其它配置不做展示
...

然后可以重启ngnix验证日志是否改为了json.

./nginx -s reload

第二步：修改FileBeat
接着修改FileBeat的配置文件filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/nginx/access.log  #指定监听的日志
    #- c:\programdata\elasticsearch\logs\*
  #主要是添加下方三个配置，记得和上方的paths对其（它们属于同级）
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log

最后重启FileBeat，去ES插件上查看log日志是否已经为json

更改完成！
FileBeat的版本为7.3.2，版本不同添加的参数不同！！！