编辑nginx.conf，内容如下

[root@master ~]# vim /usr/local/nginx/conf/nginx.conf

log_format json '{"@timestamp":"$time_iso8601",'
			'"host":"$server_addr",'
			'"ip":"$remote_addr",'
			'"clientip":"$remote_addr",'
			'"remote_user":"$remote_user",'
			'"request":"$request",'
			'"http_user_agent":"$http_user_agent",'
			'"size":$body_bytes_sent,'
			'"responsetime":$request_time,'
			'"upstreamtime":"$upstream_response_time",'
			'"upstreamhost":"$upstream_addr",'
			'"http_host":"$host",'
			'"requesturi":"$request_uri",'
			'"url":"$uri",'
			'"domain":"$host",'
			'"xff":"$http_x_forwarded_for",'
			'"referer":"$http_referer",'
			'"status":"$status"}';
access_log logs/access.log json;

注意：这里的Nginx配置所有访问日志，统一在/usr/local/nginx/logs/access.log。

如果你的环境，单独为每一个虚拟主机分配了access日志，那么就需要在对应的虚拟主机配置文件，应用格式json即可。

二、配置Logstash

注意：本文采用Filebeat+Logstash采集nginx日志，并发送给Elasticsearch。

[root@master ~]# cat /etc/logstash/conf.d/nginx.conf

input {
    redis {
        host => "172.27.5.51"
        port => "6379"
        db => "0"
        password => "Aa123456"
        data_type => "list"
        key => "nginx-access-log"
        codec => "json"
    }
}

filter {
if \[fields\]\[logtype\] == "nginx-access-log" {
json {
source =\> "message"
}


       mutate {
         convert =&gt; [ "status","integer" ]
         convert =&gt; [ "size","integer" ]
         convert =&gt; [ "upstreamtime","float" ]
         convert =&gt; [ "[geoip][coordinates]","float" ]
         remove_field =&gt; "geoip.continent_code"
         remove_field =&gt; "geoip.country_code2"
         remove_field =&gt; "geoip.country_code3"
       }

       date {
         match =&gt; [ "timestamp" ,"dd/MMM/YYYY:HH:mm:ss Z" ]
       }
       
       geoip {
         source =&gt; "ip"
         target =&gt; "geoip"
         database =&gt;"/usr/share/logstash/GeoLite2-City_20221206/GeoLite2-City.mmdb"
         add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
         add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
       }
       
       mutate {
         remove_field =&gt; "timestamp"
       }




}
}
output {
if \[fields\]\[logtype\] == "nginx-access-log" {
elasticsearch {
hosts =\> \["172.27.5.51:9200"\]
user =\> "elastic"
password =\> "www.yangxingzhen.com"
action =\> "index"
index =\> "nginx-access-log-%{+YYYY.MM.dd}"
}
}
}

注意：/usr/share/logstash/GeoLite2-City_20221206/GeoLite2-City.mmdb，这个是地图数据文件。

GeoLite2-City.mmdb是IP信息解析和地理定位的。官方下载地址：https://www.maxmind.com。

下载文件完成后，将此文件上传到/usr/share/logstash/GeoLite2-City_20221206目录。