之前为了便于python分析nginx日志,将日志格式改为json格式。但是用goaccess分析json格式还需要再下配置。
nginx中格式配置如下:
log_format api escape=json '{' '"remote_addr":"$remote_addr",' '"X-Forwarded-For":"$http_X_Forwarded_For",' '"remote_user":"$remote_user",' '"time_local":"$time_local",' #'"request":"$request",' '"method":"$request_method",' '"uri":"$uri",' '"server_protocol":"$server_protocol",' '"request_body":"$request_body",' '"status":"$status",' '"body_bytes_sent":"$body_bytes_sent",' '"http_referer":"$http_referer",' '"user_agent":"$http_user_agent",' '"upstream_response_time":"$upstream_response_time"' '}';
nginx访问日志如下:
{"remote_addr":"115.220.x.x","X-Forwarded-For":"","remote_user":"","time_local":"09/Apr/2020:13:28:09 +0800","method":"POST","uri":"/xxx/xxx","server_protocol":"HTTP/1.1","request_body":"xxxxxxx","status":"200","body_bytes_sent":"468","http_referer":"","user_agent":"Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/70.0.3538.64 Mobile Safari/537.36","upstream_response_time":"0.003"}
goaccess 官方配置文档:https://goaccess.io/man#custom-log
goaccess配置文件:
time-format %H:%M:%S # 定义时分秒格式 通过%t调用 date-format %d/%b/%Y # 定义日期格式 通过%d调用 log-format %^:"%h",%^:%^,%^:%^,%^:"%d:%t %^",%^:"%m",%^:"%U",%^:"%H",%^:%^,%^:"%s",%^:%^,%^:"%R",%^:"%u",%^:%^
拼出来要匹配的json格式(等于保留冒号和逗号),还是跟以前一样通过%^忽略某个字段,如:
第一个%^即可忽略{“remote_addr”部分,冒号后面双引号中的%h即可匹配到客户端ip地址,以此来依次匹配出需要的字段。
原创文章,转载请注明。本文链接地址: https://www.rootop.org/pages/4742.html