基于ELK的nginx-qps监控解决方案

log_format json '{"@timestamp":"$time_iso8601",'
                '"@version":"1",'
                '"server_addr":"$server_addr",'
                '"remote_addr":"$remote_addr",'
                '"host":"$host",'
                '"uri":"$uri",'
                '"body_bytes_sent":$body_bytes_sent,'
                '"bytes_sent":$body_bytes_sent,'
                '"upstream_response_time":$upstream_response_time,'
                '"request":"$request",'
                '"request_length":$request_length,'
                '"request_time":$request_time,'
                '"status":"$status",'
                '"http_referer":"$http_referer",'
                '"http_x_forwarded_for":"$http_x_forwarded_for",'
                '"http_user_agent":"$http_user_agent"'
                '}';

access_log  log/access.log   json ; 

输出的日志大约是这样
{"@timestamp":"2018-01-21T17:13:20+08:00","@version":"1","server_addr":"2.2.2.2","remote_addr":"1.1.1.1","host":"xxx.tencentyun.com","uri":"/interfaces/interface.php","upstream_response_time":0.131,"body_bytes_sent":312,"bytes_sent":489,"request":"POST /interfaces/interface.php HTTP/1.0","request_length":372,"request_time":0.238,"status":"200","http_referer":"-","http_x_forwarded_for":"-","http_user_agent":"-"}

output.elasticsearch:
  hosts: ["your.elk.address:9200"]
  index: "%{[name]}-%{+yyyyMMdd}"

filebeat.prospectors:

## nginx相关日志的探测器
- input_type: log

  paths:
    - /data/log/tnginx_1_0_0-1.0/access.log 

  fields:
    name: "nginx_log_json"
    ## this is 自定义字段，方便后续按集群名字汇总。 当然也可以起其它名字
    cluster_name: web-access

 ## 一些filebeat的配置，包括从最后一行读取，文件自动释放FD等
 tail_files: true
 close_removed: true
 close_remane: true
 close_inactive: 1h
 ignore_older: 1h
  
  ##非常关键， 自定义的字段在root层。 这个后面稍后讲
  fields_under_root: true
  ##日志以json的方式进行本地解析， 拆词后的发送到filebeat 
  json.keys_under_root: true
  json.add_error_key: true

{
  "_index": "nginx_log_json-20180121",
  "_type": "doc",
  "_id": "AWEX-dUURCyizcQtzIkX",
  "_score": null,
  "_source": {
    "@timestamp": "2018-01-21T09:12:23.525Z",
    "@version": "1",
    "beat": {
      "hostname": "100_125_96_55",
      "name": "100_125_96_55",
      "version": "5.5.0"
    },
##这一层就是root层， 所有的自定义变量会在这个层级上
    "body_bytes_sent": 1098,
    "bytes_sent": 1303,
    "cluster_name": "web-access",      ##这个是上面自定义的字段
    "host": "xxx.tencentyun.com",
    "http_referer": "-",
    "http_user_agent": "-",
    "http_x_forwarded_for": "-",
    "input_type": "log",
    "name": "nginx_log_json",
    "offset": 192139484,
    "remote_addr": "2.2.2.2",
    "request": "POST /interfaces/interface.php HTTP/1.1",
    "request_length": 432,
    "request_time": 0.045,
    "server_addr": "1.1.1.1",
    "source": "/data/log/tnginx_1_0_0-1.0/access.log",
    "status": "200",
    "type": "log",
    "upstream_response_time": 0.026,
    "uri": "/interfaces/interface.php"
  },
  "fields": {
    "@timestamp": [
      1516525943525
    ]
  },
  "highlight": {
    "cluster_name": [
      "@kibana-highlighted-field@trade@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1516525943525
  ]
}