Logstash nginx pattern
2018-06-12 本文已影响15人
挨踢的懒猫
路径vim /usr/share/logstash/patterns/nginx:
NGINXUSER %{EMAILADDRESS}|%{USER}
NGINXERROR_DATE %{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}
# Log formats
NGINX_COMMONLOG %{IPORHOST:clientip} %{NGINXUSER:ident} %{NGINXUSER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
NGINX_ACCESSLOG %{NGINX_COMMONLOG} %{QS:referrer} %{QS:agent} %{QS:x_forwarded_for}
NGINX_ERRORLOG %{NGINXERROR_DATE:date} %{TIME:time} \[%{LOGLEVEL:loglevel}\] %{POSINT:pid}#%{NUMBER:tid}: %{GREEDYDATA:errormessage}(?:, client: %{IPORHOST:server})(?:, server: %{IPORHOST:server}?)(?:, request: %{QS:request})?(?:, upstream: (?<upstream>\"%{URI}\"|%{QS}))?(?:, host: %{QS:request_host})?(?:, referrer:\"%{URI:referrer}\")?
