场景示例 Nginx 访问日志
2024-03-30 07:52:51
http {
include mime.types;
default_type application/octet-stream;
log_format main '$remote_addr [$time_local] "$request" '
'$request_body $status $body_bytes_sent "$http_referer" "$http_user_agent" '
'$request_time $http_x_forwarded_for';
日志格式:
121.40.228.39 [01/Sep/2016:11:04:46 +0800] "GET / HTTP/1.1" - 200 20698 "-" "curl/7.44.0" 0.001 -
10.168.255.134 [01/Sep/2016:11:04:48 +0800] "GET /account/fund/fundDetail.html?1472699086917 HTTP/1.1" - 200 3777 "https://wenjinbao.winfae.com/account/myAccount.html" "Mozilla/5.0 (Windows NT 5.1)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.108 Safari/537.36 2345Explorer/7.1.0.12633" 0.000 115.226.250.21
}
filter {
grok {
match => {
"message" => "%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" \- %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?
<http_referer>\S+)\" \"(?<http_user_agent>(\S+\s+)*\S+)\" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)"
}
}
}
elasticsearch:
{
"_index": "logstash-wj-frontend-2016.09.01",
"_type": "wj_frontend_access",
"_id": "AVbju8BdiJd39o4dhL8S",
"_version": 1,
"_score": 1,
"_source": {
"message": " 10.168.255.134 [01/Sep/2016:11:14:16 +0800] "GET /resources/css/productInfo.74752cfb.css?_v=${last.updated} HTTP/1.1" - 200 20102
"https://wenjinbao.winfae.com/products/productInfo.html?productSn=634" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" 0.001
115.234.131.214",
"@version": "1",
"@timestamp": "2016-09-01T03:14:48.323Z",
"path": "/data01/applog_backup/winfae_log/wj-frontend01-access.2016-09-01",
"host": "dr-mysql01.zjcap.com",
"type": "wj_frontend_access",
"clientip": "10.168.255.134",
"time": "01/Sep/2016:11:14:16 +0800",
"verb": "GET",
"request": "/resources/css/productInfo.74752cfb.css?_v=${last.updated}",
"httpversion": "1.1",
"http_status_code": "200",
"bytes": "20102",
"http_referer": "https://wenjinbao.winfae.com/products/productInfo.html?productSn=634",
"http_user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36",
"request_time": "0.001",
"http_x_forwarded_for": "115.234.131.214"
}
}
最新文章
- js 基础
- .net操作word lib DocX
- 洛谷P2246 SAC#1 - Hello World（升级版）
- PHP访问MSSQL数据库（实例代码）
- weiphp执行的流程
- Java数据类型中String、Integer、int相互间的转换
- 转：The Knuth-Morris-Pratt Algorithm in my own words
- Java获取操作系统信息
- .Net中的Placeholder控件
- 《JS权威指南学习总结--1.2客户端JS》
- Java基本数据类型和关键字
- javaweb学习总结(七)——HttpServletResponse对象(一)（转）
- intellij idea解除svn关联
- Can not deserialize instance of xxx out of START_ARRAY token
- Spark基本架构及原理
- 20165225《Java程序设计》第七周学习总结
- 剥开比原看代码13：比原是如何通过/list-balances显示帐户余额的？
- Java基础-SSM之Spring和Mybatis整合案例
- Git 基础 —— 安装 配置 别名 对象
- Gitlab搭建安装及使用中遇到的问题。