logstash收集Nginx日志，转换为JSON格式

Nginx日志处理为JSON格式，并放置在http区块：

  log_format  json  '{"@timestamp":"$time_iso8601",'
                       '"@version":"1",'
                       '"client":"$remote_addr",'
                       '"url":"$uri",'
                       '"status":"$status",'
                       '"domain":"$host",'
                       '"host":"$server_addr",'
                       '"size":"$body_bytes_sent",'
                       '"responsentime":"$request_time",'
                       '"referer":"$http_referer",'
                       '"useragent":"$http_user_agent"'
                        '}';
 access_log  logs/access_json.log  json;

Nginx日志格式

logstash配置文件：

 input {
        file {
       path =>"/usr/local/nginx/logs/access_json.log"
       codec =>"json"
       start_position => "beginning"

         }
 }

 filter{
    json {
                 source => "message"
                 skip_on_invalid_json => true
                 }
 }
 output{

       elasticsearch {
        hosts =>["172.16.3.160:9200"]
        index => "logstash-zabbix-nginx-log-%{+YYYY.MM.dd}"

            }
 }

logstash配置文件