nginx 访问日志格式
自定义默认格式日志
如果是要保留日志的源格式,只是添加相应的日志内容,则配置如下:
# vim /apps/nginx/conf/nginx.conf
user nginx;
worker_processes auto;
worker_cpu_affinity 00000001 00000010 00000100 00001000;
#error_log logs/error.log;
#error_log logs/error.log notice;
error_log logs/error.log debug;
pid logs/nginx.pid;
events {
worker_connections 65536;
}
http {
include mime.types;
default_type application/octet-stream;
include /apps/nginx/conf/conf.d/*.conf;
log_format nginx_format1 '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
#重启nginx并访问测试日志格式
自定义json格式日志
Nginx 的默认访问日志记录内容相对比较单一,默认的格式也不方便后期做日志统计分析,生产环境中通常将
nginx日志转换为json日志,然后配合使用ELK做日志收集-统计-分析。
log_format access_json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr",'
'"http_host":"$host",'
'"uri":"$uri",'
'"domain":"$host",'
'"xff":"$http_x_forwarded_for",'
'"referer":"$http_referer",'
'"tcp_xff":"$proxy_protocol_addr",'
'"http_user_agent":"$http_user_agent",'
'"status":"$status"}';
access_log /apps/nginx/logs/access_json.log access_json; #log路径为nginx编译路径,根据自身nginx的log路径修改,防止报错
#重启Nginx并访问测试日志格式
json格式的日志访问统计
在此致谢马哥教育张世杰老师,脚本来自张世杰老师
#!/usr/bin/env python
#coding:utf-8
#Author:Zhang ShiJie
status_200= []
status_404= []
with open("access_json.log") as f:
for line in f.readlines():
line = eval(line)
if line.get("status") == "200":
status_200.append(line.get)
elif line.get("status") == "404":
status_404.append(line.get)
else:
print("状态码 ERROR")
f.close()
print "状态码200的有--:",len(status_200)
print "状态码404的有--:",len(status_404)
#保存日志文件到指定路径并进测试:
[root@s2 ~]# python nginx_json.py
状态码200的有--: 1910
状态码404的有--: 13