centos7 配置ELK 搭建监控nginx 状态...

在安装nginx配置环境

bash: yun: 未找到命令...
[root@localhost ELK] yum -y install gcc gcc-c++ pcre-devel zlib zlib-devel
[root@localhost ELK] tar zxf nginx-1.16.1.tar.gz 
[root@localhost ELK] cd nginx-1.16.1/
[root@localhost nginx-1.16.1] ./configure &> /dev/null
[root@localhost nginx-1.16.1] make && make install

启动nginx

[root@localhost nginx-1.16.1] /usr/local/nginx/sbin/nginx 
[root@localhost nginx-1.16.1] netstat -nlpt | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      71423/nginx: master 

关闭防火墙并且查看

[root@localhost nginx-1.16.1] systemctl stop firewalld
[root@localhost nginx-1.16.1] setenforce 0

进入配置路径，编写正则过滤日志文件

cd /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns

[root@localhost patterns] vim nginx_access
[root@localhost patterns] cat nginx_access 
NGINXACCESS %{
     IPORHOST:client_ip} (%{
     USER:ident}|- ) (%{
     USER:auth}|-) \[%{
     HTTPDATE:timestamp}\] "(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)" %{
     NUMBER:status} (?:%{
     NUMBER:bytes}|-) "(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}"

编写管道配置文件和，模块配置文件
可有可无

[root@localhost patterns] vim /etc/logstash/pipelines.yml
- pipeline.id: msg
  path.config: "/etc/logstash/conf.d/messages.conf"
- pipeline.id: sec
  path.config: "/etc/logstash/conf.d/secure.conf"
- pipeline.id: nginx
  path.config: "/etc/logstash/conf.d/nginx.conf"

[root@localhost patterns] vim /etc/logstash/conf.d/nginx.conf
input {
     
        file {
     
                path => "/usr/local/nginx/logs/access.log" #源码安装nginx日志地址
                type => "nginx-log"
                start_position => "beginning"
        }
}
filter {
     
        grok {
     
                match => {
      "message" => "%{NGINXACCESS}" }
        }
}
output {
     
        elasticsearch {
     

                hosts => "192.168.245.173:9200" #A主ip
                index => "nginx_log-%{+YYYY.MM.dd}"
        }
}

重新启动logstash

[root@localhost patterns] systemctl restart logstash

配置nginx视图



nginx状态



pv访问数量




添加ip访问量前10的ip





访问量趋势




创建仪表盘

点击Add