1.准备好nginx日志，我弄了部分数据，E:\log\1.log
42.156.138.7 - - [26/Apr/2017:00:00:08 +0800] "GET /checkpop?v=20170425135147 HTTP/1.1" 200 934 "http://www.baidu.com/shop/22265.html" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b13pre) Gecko/20110307 Firefox/4.0b13pre"
42.156.138.7 - - [26/Apr/2017:00:00:08 +0800] "GET /static/js/stat.js?v=20170425135147 HTTP/1.1" 200 598 "http://www.baidu.com/shop/22265.html" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b13pre) Gecko/20110307 Firefox/4.0b13pre"
111.205.96.2 - - [26/Apr/2017:00:00:08 +0800] "GET /monitor/sm_check/sms_allowance HTTP/1.1" 200 20 "-" "curl/7.19.7 (i686-pc-linux-gnu) libcurl/7.19.7 NSS/3.12.6.2 zlib/1.2.3 libidn/1.18 libssh2/1.2.2"
103.21.119.132 - - [26/Apr/2017:00:00:08 +0800] "POST /ajax/checkPhone HTTP/1.1" 200 22 "http://passport.baidu.com/signup" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
42.156.138.7 - - [26/Apr/2017:00:00:08 +0800] "GET /api/pv?id=22265&type=shop&t=93504578558ff728767a82 HTTP/1.1" 200 31 "http://www.baidu.com/shop/22265.html" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b13pre) Gecko/20110307 Firefox/4.0b13pre"
111.205.96.2 - - [26/Apr/2017:00:00:08 +0800] "GET /monitor/sm_check/order_num HTTP/1.1" 200 15 "-" "curl/7.19.7 (i686-pc-linux-gnu) libcurl/7.19.7 NSS/3.12.6.2 zlib/1.2.3 libidn/1.18 libssh2/1.2.2"2.在logstash/bin文件夹下新建test.conf文件,内容如下
input {
file {
path => "E:/log/1.log"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => "%{IP:client} - - \[%{HTTPDATE:logdate}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:http_status_code} %{NUMBER:bytes} \"%{NOTSPACE:ref}\" \"%{DATA:user_agent}\"" }
}
date {
match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"]
target => "@timestamp"
}
kv {
source => "request"
field_split => "&?"
value_split => "="
}
urldecode {
all_fields => true
}
}
output {
elasticsearch {
hosts => "localhost:9200"
}
stdout {
codec => json_lines
}
}3.进入bin文件夹下运行logstash.bat -f test.conf，如下图所示，表示数据导入成功
4.进行日志查看.启动kibana5.3服务，登录后左侧目录找Management->Index Patterns->add New
然后记得选择时间
