Skip to content

Instantly share code, notes, and snippets.

@tureki
Last active August 29, 2015 14:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tureki/11038609 to your computer and use it in GitHub Desktop.
Save tureki/11038609 to your computer and use it in GitHub Desktop.
Nginx's Log to Elasticsearch
input {
file {
type => "nginx_access"
codec=>json
path => ["/var/log/nginx/**"]
exclude => ["*.gz", "error.*"]
discover_interval => 10
sincedb_path => "/opt/logstash/.sincedb"
}
}
filter {
grok {
match => [ "message","%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{TIMESTAMP_ISO8601:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}"]
}
}
output {
elasticsearch {
host => "HOSTNAME"
index=>"ngx-access-%{+YYYY.MM.DD}"
index_type => "nginx"
cluster=>"ELASTICSEARCH CLUSTER NAME"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment