Logstash收集nginx error日志

发表于 2018-08-17 | 分类于 ELK | 评论数：

之前写过收集nginx的日志，但那只是收集了nginx的access日志，接下来我们实现以下收集nginx的error日志，方便出现问题时，通过日志来排查问题

说明

1 2	ELK服务器IP：192.168.10.21 Nginx服务器IP：192.168.10.26

1、修改Logstash客户端配置文件

vim /etc/logstash/nginx_error.conf

input {
#nginx_error
    file {
        path => "/a01/apps/nginx/log/error.log"
        type => "nginx_error"
        }


}


output {
    if [type] == "nginx_error" {
        rabbitmq {
          host => "192.168.10.21"
          port => 5672
          key => "nginx_error"
          user => "nong"
          password => "nong"
          exchange => "amq.direct"
          exchange_type => "direct"
            }
          }


}

2、检查配置文件是否正确

1	/a01/apps/logstash/bin/logstash -t -f /etc/logstash/

3、修改Logstash服务端配置文件

vim /etc/logstash/nginx_error.conf

input {
#nginx_error
  rabbitmq {
    host => "192.168.10.21"
    port => 5672
    key => "nginx_error"
    user => "nong"
    password => "nong"
    exchange => "amq.direct"
    exchange_type => "direct"
  }


}

output {
  if [type] == "nginx_error" {
      elasticsearch {
        hosts => "192.168.10.21:9200"
        index => "nginx_error-%{+YYYY.MM.dd}"
        }
}


}