Apache 自定义 JSON 格式日志

原文出处：http://blog.mreald.com

cat  httpd.conf

    LogFormat  "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""  combined
    LogFormat  "%h %l %u %t \"%r\" %>s %b"  common
    #CustomLog "logs/access_log" common
    CustomLog  "logs/access_log"  combined
< /IfModule >

输出格式：

common : 

10.13.52.170 - - [17/Dec/2014:17:17:47 +0800] "GET /index.php HTTP/1.1" 200 10595

combined:

10.13.52.170 - - [17/Dec/2014:17:19:40 +0800] "GET /index.php HTTP/1.1" 200 10548 "http://blog.mreald.com/index.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"

解释：LogFormat 定义两种格式， common、combined 供下面or 以后引用
%h host
%u user
%t  time
%s status   <表示原始请求，>表示转换后的请求
%b back bit 返回字节数
%i  identify  定义你要的信息， User-Agent 代表用户浏览器

更改日志显示格式：

1.改 httpd.conf

2.改 自定义的vhosts.conf

cat   vhosts.conf
# Virtual Hosts
Listen 8333
Listen 8444

    ServerAdmin [email protected]
    DocumentRoot  "/mreald"
    ServerName blog.mreald.com
    ServerAlias blog.mreald.com
    ErrorLog  "logs/mreald-error_log"
    CustomLog  "logs/mreald-access_log"  combined
    #CustomLog "logs/mreald-access_log" common
 /mreald/ >
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
DirectoryIndex index.php index.html
    < /Directory >
< /VirtualHost >

可以定义下面的JSON格式日志输出

LogFormat "{ \

\"host\":\"host.example.com\", \

\"path\":\"/var/log/httpd/logstash_access_log\", \

\"tags\":[\"wordpress\",\"www.example.com\"],

\

\"message\": \"%h %l %u %t \\\"%r\\\" %>s

%b\", \

\"timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \

\"clientip\": \"%a\", \

\"duration\": %D, \

\"status\": %>s, \

\"request\": \"%U%q\", \

\"urlpath\": \"%U\", \

\"urlquery\": \"%q\", \

\"method\": \"%m\", \

\"bytes\": %B, \

\"vhost\": \"%v\" \

}" apache_json