日志转换成json格式

apache_access.log

将LogFormat 原配置行注释。添加如下内容：

LogLevel warn

LogFormat "{ \

\"@timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \

\"@version\": \"1\", \

\"tags\":[\"apache\"], \

\"message\": \"%h %l %u %t \\\"%r\\\" %>s %b\", \

\"clientip\": \"%a\", \

\"duration\": %D, \

\"status\": %>s, \

\"request\": \"%U%q\", \

\"urlpath\": \"%U\", \

\"urlquery\": \"%q\", \

\"bytes\": %B, \

\"method\": \"%m\", \

\"site\": \"%{Host}i\", \

\"referer\": \"%{Referer}i\", \

\"useragent\": \"%{User-agent}i\" \

}" ls_apache_json

CustomLog logs/access_log.ls_json ls_apache_json

重启apache程序

---------------------------------------------------------------------------------------------------

nginx_access.log

将log_format 原配置行注释，添加如下内容：

log_format logstash_json '{ "@timestamp": "$time_local", '

'"@fields": { '

'"remote_addr": "$remote_addr", '

'"remote_user": "$remote_user", '

'"body_bytes_sent": "$body_bytes_sent", '

'"request_time": "$request_time", '

'"status": "$status", '

'"request": "$request", '

'"request_method": "$request_method", '

'"http_referrer": "$http_referer", '

'"body_bytes_sent":"$body_bytes_sent", '

'"http_x_forwarded_for": "$http_x_forwarded_for", '

'"http_user_agent": "$http_user_agent" } }';

access_log /usr/local/nginx/logs/access_json.log logstash_json;

重启nginx程序

---------------------------------------------------------------------------------------------------

Tomcat 利用log4j，日志输出格式为json

进入到Tomcat的lib目录：

cd /usr/local/tomcat8.5.14/lib

wget http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.42/bin/extras/tomcat-juli-adapters.jar

wget https://archive.apache.org/dist/logging/log4j/1.2.17/log4j-1.2.17.jar

进入到Tomcat的bin目录：

cd /usr/local/tomcat8.5.14/bin

mv tomcat-juli.jar tomcat-juli.jar.bak

wget http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.42/bin/extras/tomcat-juli.jar

进入到Tomcat的conf目录：

mv logging.properties  logging.properties.bak

编辑 context.xml，将Context标题修改为如下内容：

进入到tomcat的lib目录：

创建log4j.properties,其catalina日志为滚动日志,json格式输出

vim log4j.properties

log4j.rootLogger = INFO, CATALINA

# Define all the appenders

log4j.appender.CATALINA=org.apache.log4j.RollingFileAppender

log4j.appender.CATALINA.File=${catalina.base}/logs/catalina

log4j.appender.CATALINA.layout=org.apache.log4j.PatternLayout

log4j.appender.CATALINA.layout.ConversionPattern={"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n

log4j.appender.CATALINA.MaxFileSize=2MB

log4j.appender.CATALINA.MaxBackupIndex=10

log4j.appender.LOCALHOST = org.apache.log4j.DailyRollingFileAppender

log4j.appender.LOCALHOST.File = ${catalina.base}/logs/localhost

log4j.appender.LOCALHOST.Append = true

log4j.appender.LOCALHOST.Encoding = UTF-8

log4j.appender.LOCALHOST.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.LOCALHOST.layout = org.apache.log4j.PatternLayout

log4j.appender.LOCALHOST.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.MANAGER = org.apache.log4j.DailyRollingFileAppender

log4j.appender.MANAGER.File = ${catalina.base}/logs/manager

log4j.appender.MANAGER.Append = true

log4j.appender.MANAGER.Encoding = UTF-8

log4j.appender.MANAGER.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.MANAGER.layout = org.apache.log4j.PatternLayout

log4j.appender.MANAGER.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.HOST-MANAGER = org.apache.log4j.DailyRollingFileAppender

log4j.appender.HOST-MANAGER.File = ${catalina.base}/logs/host-manager

log4j.appender.HOST-MANAGER.Append = true

log4j.appender.HOST-MANAGER.Encoding = UTF-8

log4j.appender.HOST-MANAGER.DatePattern = '.'yyyy-MM-dd'.log'

log4j.appender.HOST-MANAGER.layout = org.apache.log4j.PatternLayout

log4j.appender.HOST-MANAGER.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

log4j.appender.CONSOLE = org.apache.log4j.ConsoleAppender

log4j.appender.CONSOLE.Encoding = UTF-8

log4j.appender.CONSOLE.layout = org.apache.log4j.PatternLayout

log4j.appender.CONSOLE.layout.ConversionPattern = %d [%t] %-5p %c- %m%n

# Configure which loggers log to which appenders

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost] = INFO, LOCALHOST

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager] =\

  INFO, MANAGER

log4j.logger.org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager] =\

  INFO, HOST-MANAGER

重启Tomcat，并检查日志输出格式：

tail -f usr/log/tomcat8.5.14/logs/catalina

日志输出到catalina，而非catalina.out文件。