centos 7 EFK安装部署监控nginx

搭建EFK架构
安装kafka：
https://blog.csdn.net/RoninLJH/article/details/107028599
安装filebeat：
https://blog.csdn.net/RoninLJH/article/details/107111943
安装ELK：
https://blog.csdn.net/RoninLJH/article/details/107006273

需要修改filebeat

[root@kafka01 ~]# vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/messages
fields:
log_topics: messages
####
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
fields:
log_topics: nginx
output.kafka:
enabled: true
hosts: ["192.168.33.143:9092","192.168.33.144:9092","192.168.33.145:9092"]
topic: '%{[fields][log_topics]}'

需要修改nginx.conf

[root@kafka01 ~]# vim /etc/logstash/conf.d/nginx.conf
input {
kafka{
bootstrap_servers => ["192.168.33.143:9092,192.168.33.144:9092,192.168.33.145:9092"]
group_id => "logstash"
topics => "nginx"
consumer_threads => 5
}
}
filter {
json {
source => "message"
}
mutate {
remove_field => ["fields","prospector","host","log"]
}
grok {
match => {"message" => "%{NGINXACCESS}"}
}
}
output {
elasticsearch {
hosts => "192.168.33.144:9200"
index => "nginx_log-%{+YYYY.MM.dd}"
}
#       stdout {
#               codec => rubydebug
#       }
}