ELK 收集nginx日志数据

Posted by zhulinpinyu on December 8, 2016

Test Environment:

  • macOS 10.12.1
  • Docker for Mac v1.12.1
  • Elasticsearch v5.0.0
  • Logstash v5.0.2
  • Kibana v5.0.0
  • Nginx v1.10.2

Step 1. start elasticsearch

docker run -d --name es elasticsearch:5.0.0

Step 2. start logstash

docker run -d \
	--name logstash \
	--link es:elasticsearch \
	-v $(pwd)/config/logstash.conf:/config-dir/logstash.conf \
	logstash:5.0.2 \
	logstash -f /config-dir/logstash.conf

config/logstash.conf

input {
  gelf {}
}
output {
  elasticsearch {
    hosts => ["elasticsearch"]
  }
  stdout {}
}

Step 3. start Kibana

docker run -d \
	--name kibana \
	--link es:elasticsearch \
	-p 5601:5601 \
	kibana:5.0.0

Step 4. start Nginx

docker run --rm \
  -p 80:80 \
  --log-driver=gelf \
  --log-opt gelf-address=udp://$(docker inspect --format '双花括号 .NetworkSettings.IPAddress 双花括号' logstash):12201 \
  --log-opt tag="test" nginx:1.10.2

Notes: get logstash ip address

docker inspect --format '双花括号 .NetworkSettings.IPAddress 双花括号' logstash

原图

Step 5. setup kibana

visit nginx: http://localhost or http://Your-IP

visit http://Your-ip:5601 , setup kibana. you will see follow graph.

ELK

Thanks: https://gist.github.com/shreyu86/735f2871460a2b068080