zoukankan      html  css  js  c++  java
  • logstash grok切分nginx日志

    日志类型

    map $http_x_forwarded_for $clientRealIp {
    "" $remote_addr;
    ~^(?P<firstAddr>[0-9.]+),?.*$ $firstAddr;
    }

    log_format  proxy_main  '$clientRealIp "$http_x_forwarded_for" $remote_addr - $remote_user [$time_local] "$request" '
                            '$status $body_bytes_sent "$http_referer" '
                            '"$http_user_agent" $request_time $upstream_response_time '
                            '$proxy_host $upstream_addr';

    日志格式

    120.92.12.137 "1.1.1.1, 2.2.2.2" 120.92.12.137 - - [10/Jul/2019:03:38:16 +0000] "GET /api HTTP/1.1" 406 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.3 skyeye-scanner" 0.105 0.104 127.0.0.1:8080 127.0.0.1:8080

    切分格式

    (?<clientRealIp>%{IP}|-) "(?<http_x_forwarded_for>([0-9., ]+|-))"s(?<remote_addr>%{IP}|-)s-s%{NOTSPACE:remote_user} [%{HTTPDATE:time_local}] "%{WORD:method} (?<request_uri>(.*)) HTTP/%{NUMBER:http_version}" %{NUMBER:status} (?:%{NUMBER:body_bytes}|-) "%{NOTSPACE:http_referer}" %{QS:agent} %{NUMBER:request_time} %{NUMBER:upstream_response_time} (?:%{HOSTPORT:proxy_host}|-) (?:%{HOSTPORT:upstream_addr}|-)
  • 相关阅读:
    Python爬虫的开发
    JSON
    XPath
    w3c
    Python I/O操作
    【转】C语言中DEFINE简介及多行宏定义
    【转】C++中#if #ifdef 的作用
    srand()、rand()、time()函数的用法
    排序算法之冒泡排序、选择排序
    Java Spring学习笔记
  • 原文地址:https://www.cnblogs.com/lfdblog/p/11170735.html
Copyright © 2011-2022 走看看