log_format json '{"@timestamp":"$time_iso8601",'
'"@version":"1",'
'"client":"$remote_addr",'
'"url":"$uri",'
'"status":"$status",'
'"domain":"$host",'
'"host":"$server_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"referer": "$http_referer",'
'"ua": "$http_user_agent"'
'}';
access_log /data/nginx/logs/access_json.log json;
version: "3"
services:
elasticsearch:
image: "elasticsearch:7.1.1"
container_name: "elasticsearch"
restart: "always"
volumes:
- "elasticsearch:/usr/share/elasticsearch"
#vim /etc/sysctl.conf
#vm.max_map_count=262144
#sysctl -w vm.max_map_count=262144
#sysctl -p
environment:
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
- discovery.type=single-node
networks:
- "elk"
ports:
- "9200:9200"
- "9300:9300"
kibana:
image: "kibana:7.1.1"
container_name: "kibana"
restart: "always"
depends_on:
- elasticsearch
volumes:
- "kibana:/usr/share/kibana"
networks:
- "elk"
ports:
- "5601:5601"
logstash:
image: "logstash:7.1.1"
container_name: "logstash"
restart: "always"
networks:
- "elk"
ports:
- "5044:5044"
- "9600:9600"
volumes:
- "logstash:/usr/share/logstash"
- "/data/nginx/logs:/data/nginx/logs"
networks:
elk:
volumes:
elasticsearch:
logstash:
kibana:
path.config: /usr/share/logstash/conf.d/*.conf
input {
file {
type => "nginx-access-log"
path => "/data/nginx/logs/access_json.log"
start_position => "beginning"
stat_interval => "2"
codec => json
}
}
filter {}
output {
elasticsearch {
hosts => ["http://elasticsearch:9200"]
#index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
index => "logstash-nginx-access-log-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"
}
stdout {
codec => json_lines
}
}
