Graylog2 (apache and nginx)

django-settings.py

"""
... some code
"""
import socket


HOSTNAME=socket.gethostname()

"""
... some more code
"""

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'handlers': {
        'graypy': {
            'level': 'WARNING',
            'class': 'graypy.GELFHandler',
            'host': 'XYZ',
            'port': 13201,
            'localname': 'django-blog-test-app@'+HOSTNAME,
        },
    },
    'loggers': {
        'django': {
            'handlers': ['graypy'],
            'level': os.getenv('DJANGO_LOG_LEVEL', 'INFO'),
            'propagate': True,
        },
    },
}

gunicorn-syslog-enable.sh

GRAYLOG_ENABLE="--log-syslog --log-syslog-to udp://XYZ:TCP_PORT"
GUNICORN_ARGS="-t 300 -D -b 127.0.0.1:8001 -w 9 --log-syslog ${GRAYLOG_ENABLE} ..."

httpd-graylog-logformat.conf

# Configures graylog format (GELF)
LogFormat "{ \"version\": \"1.1\", \"host\": \"%V\", \"short_message\": \"%r\", \"timestamp\": %{%s}t, \"level\": 6, \"_user_agent\": \"%{User-Agent}i\", \"_source_ip\": \"%a\", \"_duration_usec\": %D, \"_duration_sec\": %T, \"_request_size_byte\": %O, \"_http_status\": %s, \"_http_request_path\": \"%U\", \"_http_request\": \"%U%q\", \"_http_method\": \"%m\", \"_http_referer\": \"%{Referer}i\" }" graylog2_access

httpd-graylog-sendlog.inc

CustomLog "|nc -u 172.17.2.244 12201" graylog2_access
ErrorLog logs/intra-hml.mp.rs.gov.br-error.log

nginx-graylog-logformat.conf

log_format json_logs '{ '
 '"timestamp": "$time_iso8601",'

 '"vhost": "$http_host",'
 '"server_port": "$server_port",'
 '"server_pid": "$pid",'

 '"source_ip": "$remote_addr",'
 '"client_port": "$remote_port",'
 '"client_user": "$remote_user",'

 '"http_method": "$request_method",'
 '"http_request": "$request",'
 '"http_request_path": "$request_uri",'
 '"http_request_uri_normalized": "$uri",'
 '"http_request_args": "$args",'
 '"http_request_protocol": "$server_protocol",'
 '"http_request_length": "$request_length",'
 '"duration_sec_with_milli": "$request_time",'

 '"ssl_protocol": "$ssl_protocol",'
 '"ssl_session_reused": "$ssl_session_reused",'

 '"http_header_cf_ip": "$http_cf_connecting_ip",'
 '"http_header_cf_country": "$http_cf_ipcountry",'
 '"http_header_cf_ray": "$http_cf_ray",'

 '"request_size_byte": "$bytes_sent",'
 '"http_response_body_size": "$body_bytes_sent",'

 '"upstream_server": "$upstream_addr",'
 '"upstream_connect_time": "$upstream_connect_time",'
 '"upstream_header_time": "$upstream_header_time",'
 '"upstream_response_time": "$upstream_response_time",'
 '"upstream_response_length": "$upstream_response_length",'
 '"upstream_status": "$upstream_status",'

 '"http_content_length": "$content_length",'
 '"http_content_type": "$content_type",'

 '"http_status": "$status",'
 '"http_referer": "$http_referer",'
 '"user_agent": "$http_user_agent"'
 ' }';

nginx-graylog-sendlog.inc

  access_log syslog:server=172.17.2.244:5514,severity=notice json_logs;
  error_log syslog:server=172.17.2.244:12302 warn;

nginx-syslog-json-extractor.json

{
  "extractors": [
    {
      "title": "Nginx fields",
      "extractor_type": "json",
      "converters": [],
      "order": 1,
      "cursor_strategy": "cut",
      "source_field": "json_message",
      "target_field": "",
      "extractor_config": {
        "list_separator": ", ",
        "kv_separator": "=",
        "key_prefix": "",
        "key_separator": "_",
        "replace_key_whitespace": false,
        "key_whitespace_replacement": "_"
      },
      "condition_type": "none",
      "condition_value": ""
    },
    {
      "title": "Nginx to JSON",
      "extractor_type": "regex",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "json_message",
      "extractor_config": {
        "regex_value": "^.*nginx: (\\{.*\\})$"
      },
      "condition_type": "string",
      "condition_value": "nginx"
    }
  ],
  "version": "2.2.0-SNAPSHOT"
}