Skip to content

Instantly share code, notes, and snippets.

@Shellbye

Shellbye/nginx_grok.conf

Last active July 8, 2020 09:11
Show Gist options
  • Save Shellbye/499c364a090e10c154977332a39614a0 to your computer and use it in GitHub Desktop.
Save Shellbye/499c364a090e10c154977332a39614a0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Shellbye revised this gist May 11, 2017. 1 changed file with 44 additions and 0 deletions.
    44 changes: 44 additions & 0 deletions nginx_grok.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,44 @@

    # https://logz.io/blog/nginx-access-log-monitoring-dashboard/
    input {
    file {
    type => nginx_web
    path => "/var/log/nginx/*"
    exclude => "*.gz"
    }
    }

    filter {
    grok {
    match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
    overwrite => [ "message" ]
    }

    mutate {
    convert => ["response", "integer"]
    convert => ["bytes", "integer"]
    convert => ["responsetime", "float"]
    }

    geoip {
    source => "clientip"
    target => "geoip"
    add_tag => [ "nginx-geoip" ]
    }

    date {
    match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
    remove_field => [ "timestamp" ]
    }

    useragent {
    source => "agent"
    }
    }

    output {
    elasticsearch {
    hosts => [ "localhost:9200" ]
    }
    }

  2. Shellbye created this gist May 11, 2017.
    41 changes: 41 additions & 0 deletions uwsgi_grok.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,41 @@
    input {
    file {
    type => uwsgi
    path => ["/path/to/uwsgi.log"]
    }
    }

    filter {
    grok {
    match => { "message" => "\[pid: %{NUMBER:pid}\|app: %{NUMBER:id}\|req: %{NUMBER:currentReq}/%{NUMBER:totalReq}\] %{IP:remoteAddr} \(%{WORD:remoteUser}?\) \{%{NUMBER:CGIVar} vars in %{NUMBER:CGISize} bytes\} \[%{DATA:timestamp}\] %{WORD:method} %{URIPATHPARAM:uri} \=\> generated %{NUMBER:resSize} bytes in %{NUMBER:resTime} msecs \(HTTP/%{NUMBER:httpVer} %{NUMBER:status}\) %{NUMBER:headers} headers in %{NUMBER:headersSize} bytes %{GREEDYDATA:coreInfo}" }
    }

    mutate {
    convert => ["status", "integer"]
    convert => ["resSize", "integer"]
    convert => ["resTime", "float"]
    }

    geoip {
    source => "remoteAddr"
    target => "geoip"
    add_tag => [ "uwsgi-geoip" ]
    }

    date {
    match => [ "timestamp", "EEE MMM d HH:mm:ss y", "EEE MMM d HH:mm:ss y" ]
    remove_field => [ "timestamp" ]
    }

    if "_grokparsefailure" in [tags] {
    drop {}
    }

    }

    output {
    elasticsearch {
    hosts => [ "localhost:9200" ]
    index => "uwsgi-%{+YYYY.MM.dd}"
    }
    }