centos 7 ELK 监控NGINX+可视化（图形化）

实验环境：（安装好ELK，安装步骤见上篇：注意关闭防火墙、selinux）
192.168.33.143
安装ES： 9200，logstash：9600
192.168.33.144
安装kibana：5601

登录在143上

创建好的nginx_access文件

[root@localhost ~]# vim nginx

NGINXACCESS %{IPORHOST:client_ip} (%{USER:ident}|- ) (%{USER:auth}|-) \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} (%{NOTSPACE:request}|-)(?: HTTP/%{NUMBER:http_version})?|-)" %{NUMBER:status} (?:%{NUMBER:bytes}|-) "(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}"

上传到下面路径：

[root@localhost patterns]# pwd
/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-patterns-core-4.1.2/patterns

安装nginx

[root@localhost ~]# yum -y install epel-release
[root@localhost ~]# yum -y install nginx
[root@localhost ~]# systemctl start nginx
[root@localhost ~]# netstat -anpt | grep nginx

修改配置文件创建索引

[root@localhost ~]# cd /etc/logstash/conf.d/
[root@localhost conf.d]# vim nginx.conf
--------------------------------------
input {
file {
path => "/var/log/nginx/access.log"
type => "nginx-log"
start_position => "beginning"
}
}
filter {
grok {
match => {"message" => "%{NGINXACCESS}"}
}
}
output {
elasticsearch {
hosts => "192.168.33.143:9200"
index => "nginx_log-%{+YYYY.MM.dd}"
}
}
---------------------------------------------
[root@localhost conf.d]# vim /etc/logstash/pipelines.yml
-----------------添加两行---------------------
- pipeline.id: nginx
path.config: "/etc/logstash/conf.d/nginx.conf"
---------------------------------------------

[root@localhost ~]# chmod -R 777 /var/log/
[root@localhost ~]# systemctl restart logstash

查看

[root@localhost ~]# tailf /var/log/logstash/logstash-plain.log

如果web端没出现nginx索引，

[root@localhost ~]# yum -y install httpd-tools
[root@localhost ~]# ab -n 1000 -c 1000 http://192.168.33.143/index.html

web端查看、设置可视化

1 添加状态码统计饼状图

2 添加一个统计pv的图形

3 添加ip访问量前10的ip




4 访问量趋势图




5 添加一个仪表盘