借一张图：
搭建版本为：
Elasticsearch：1.5.2
Logstash：1.4.2
Kibana：4.0.2
Shipper节点配置如下：
input {
file {
path => "/var/log/nginx/*_access.log"
}
}
filter {
if [path] =~ "access" {
mutate { replace => { "type" => "nginx_access" } }
grok {
match => { "message" => "%{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:timeconsumer}" }
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
output {
redis {
data_type => "list"
host => “xxx"
password => “xxx"
key => “xxx"
}
}
Indexer配置如下：
input {
redis {
data_type => "list"
host => localhost
password => “xxx"
key => “xxx"
}
}
output {
elasticsearch {
host => localhost
codec => "json"
}
}
日志分析(一) 环境准备
原文：http://www.cnblogs.com/asfeixue/p/4478018.html
