Logstash解析Nginx访问日志

Posted 2022-04-06

nginx日志格式

    log_format  main  ‘$remote_addr - $remote_user [$time_local] "$request" ‘
                      ‘$status $body_bytes_sent "$http_referer" ‘
                      ‘"$http_user_agent" "$http_x_forwarded_for" ‘
                        ‘"$http_host" "$request_time" "$upstream_response_time" $http_device $http_appversion $upstream_addr ‘
                      ‘$http_openudid $http_code $http_networkType "$http_deviceModel" "$http_osVersion"‘;

解析格式为

%IPORHOST:Client_IP (%NGUSER:ident|-) (%NGUSER:auth|-) \[%HTTPDATE:timestamp\] "%WORD:Http_Method %URIPATHPARAM:Http_Request HTTP/%NUMBER:Http_Version" %NUMBER:Http_Status_Code (?:%NUMBER:Http_Bytes|-) (?:"(?:%URI:Http_Referrer|-)"|%QS:Http_Referrer) %QS:User_Agent "(%QS:X_Forwarded_For|-)" "(%IPORHOST:Site|-)" "(%NUMBER:Request_Time|-)" "(%NUMBER:Upstream_Response_Time|-)" (%WORD:Device|-) (%USERNAME:App_Version|-) (%HOSTNAME:Upstream_Host:%POSINT:Upstram_Port|-) (%WORD:Openudid|-) (%WORD:Usercode|-) (%WORD:NetType|-) "(%GREEDYDATA:Device_Name|-)" "(%GREEDYDATA:System_Verion|-)"