bitfan-nginx

input {
    syslog {
        port => {{ bitfan_syslogd_port }}
        protocol => "udp"
        type => "syslog"
    }
}
filter {
    kv {
        field_split => "\\t"
        include_brackets => false
        source => "content"
        value_split => "="
        remove_field => ["content"]
        trim => "-"
    }
    # date {
    #     timezone => "Europe/Moscow"
    #     match => ["msec", "UNIX"]
    # }
    mutate {
        convert => {
           "rtime" => "float"
            "urtime" => "float"
        }
    }
    eval {
        expressions => {
            "rtime" => "[rtime] * 1000"
            "urtime" => "[urtime] * 1000"
        }
    }
    mutate {
      lowercase => [ "uri" ]
    }
    mutate {
      gsub => [
        "uri", "\/+", "/",
        "uri", "\/", "_",
        "uri", "^_", "",
        "uri", "_$", ""
      ]
    }
}
output {
    if [type] == "syslog" {
        statsd {
            host => "localhost"
            port => 8125
            protocol => "udp"
            namespace => "{{ graphite_prefix }}.nginx"
            sender => "marten-api"
            increment => [ "response.total.%{status}",
                           "method.total.%{method}" ]
            timing => { "response_time.total" => "%{rtime}",
                        "upstream_response_time.total" => "%{urtime}",
                        "response_bytes.total" => "%{bsent}",
                        "request_bytes.total" => "%{rlength}"
            }
        }
        if [status] != "404" and [uri] !~ "^$" {
            statsd {
                host => "localhost"
                port => 8125
                protocol => "udp"
                namespace => "{{ graphite_prefix }}.nginx"
                sender => "marten-api"
                increment => [ "response.%{uri}.%{status}" ]
                timing => { "response_time.%{uri}" => "%{rtime}",
                            "upstream_response_time.%{uri}" => "%{urtime}",
                            "response_bytes.%{uri}" => "%{bsent}",
                            "request_bytes.%{uri}" => "%{rlength}"
                }
            }
        }
    }
}

Nginx log format

log_format struct 'ip="$remote_addr"\t'
                      'xip="$http_x_real_ip"\t'
                      'user="$remote_user"\t'
                      'msec="$msec"\t'
                      'method="$request_method"\t'
                      'host="$host"\t'
                      'uri="$uri"\t'
                      'args="$args"\t'
                      'status="$status"\t'
                      'bsent="$bytes_sent"\t'
                      'rlength="$request_length"\t'
                      'referer="$http_referer"\t'
                      'uagent="$http_user_agent"\t'
                      'rtime="$request_time"\t'
                      'urtime="$upstream_response_time"\t';