Rsyslog » История » Версия 6
Константин Пильник, 2022-12-01 17:11
| 1 | 5 | Константин Пильник | h1. nginx -> rsyslog -> rsyslog-elasticsearch -> elasticsearch |
|---|---|---|---|
| 2 | |||
| 3 | 6 | Константин Пильник | apt install rsyslog-elasticsearch |
| 4 | |||
| 5 | 5 | Константин Пильник | <pre><code class="perl"> |
| 6 | module(load="omelasticsearch") |
||
| 7 | module(load="mmjsonparse") |
||
| 8 | |||
| 9 | template(name="template_nginx_yyyy_mm_dd" type="list") { |
||
| 10 | constant(value="nginx-") |
||
| 11 | property(name="timereported" dateformat="year") |
||
| 12 | constant(value=".") |
||
| 13 | property(name="timereported" dateformat="month") |
||
| 14 | constant(value=".") |
||
| 15 | property(name="timereported" dateformat="day") |
||
| 16 | } |
||
| 17 | |||
| 18 | template(name="template_msg_to_json" type="list") { |
||
| 19 | property(name="$!msg") |
||
| 20 | } |
||
| 21 | |||
| 22 | if ($programname == "nginx") then { |
||
| 23 | action(type="mmjsonparse") |
||
| 24 | action(type="omelasticsearch" |
||
| 25 | server=["https://es1.domain.tld:443", "https://es2.domain.tld:443", "https://es3.domain.tld:443"] |
||
| 26 | uid="elastic" |
||
| 27 | pwd="secret" |
||
| 28 | template="template_msg_to_json" |
||
| 29 | dynSearchIndex="on" |
||
| 30 | searchIndex="template_nginx_yyyy_mm_dd" |
||
| 31 | searchType="nginx" |
||
| 32 | bulkmode="on" |
||
| 33 | maxbytes="100m" |
||
| 34 | queue.type="linkedlist" |
||
| 35 | queue.size="5000" |
||
| 36 | queue.dequeuebatchsize="300" |
||
| 37 | action.resumeretrycount="-1" |
||
| 38 | ) |
||
| 39 | } |
||
| 40 | </code></pre> |
||
| 41 | |||
| 42 | h4. nginx/conf.d/log_format.conf |
||
| 43 | |||
| 44 | <pre><code class="perl"> |
||
| 45 | # json for elastic |
||
| 46 | # access_log syslog:server=unix:/dev/log,tag=nginx,nohostname default_json; |
||
| 47 | log_format default_json escape=json |
||
| 48 | '{' |
||
| 49 | '"args":"$args",' |
||
| 50 | '"bytes_sent":"$bytes_sent",' |
||
| 51 | '"connection": "$connection",' |
||
| 52 | '"connection_requests": "$connection_requests",' |
||
| 53 | '"hostname": "$hostname",' |
||
| 54 | '"http_referrer":"$http_referer",' |
||
| 55 | '"http_user_agent":"$http_user_agent",' |
||
| 56 | '"remote_addr":"$remote_addr",' |
||
| 57 | '"remote_port":"$remote_port",' |
||
| 58 | '"remote_user":"$remote_user",' |
||
| 59 | '"request":"$request",' |
||
| 60 | '"request_length":"$request_length",' |
||
| 61 | '"request_method":"$request_method",' |
||
| 62 | '"request_time":"$request_time",' |
||
| 63 | '"scheme": "$scheme",' |
||
| 64 | '"server_name": "$server_name",' |
||
| 65 | '"server_protocol": "$server_protocol",' |
||
| 66 | '"status": "$status",' |
||
| 67 | '"time_local":"$time_iso8601",' |
||
| 68 | '"upstream_addr": "$upstream_addr",' |
||
| 69 | '"upstream_response_time": "$upstream_response_time",' |
||
| 70 | '"upstream_status": "$upstream_status",' |
||
| 71 | '"uri": "$uri"' |
||
| 72 | '}'; |
||
| 73 | </code></pre> |
||
| 74 | |||
| 75 | 1 | Константин Пильник | h1. rsyslog -> elasticsearch |
| 76 | |||
| 77 | <pre><code class="perl"> |
||
| 78 | # elasticsearch |
||
| 79 | module(load="omelasticsearch") |
||
| 80 | template(name="elastic_date_template" type="list") { |
||
| 81 | constant(value="rsyslog-") |
||
| 82 | property(name="timereported" dateformat="year") |
||
| 83 | constant(value=".") |
||
| 84 | property(name="timereported" dateformat="month") |
||
| 85 | constant(value=".") |
||
| 86 | property(name="timereported" dateformat="day") |
||
| 87 | } |
||
| 88 | |||
| 89 | template(name="elastic_msg_template" type="list" option.json="on") { |
||
| 90 | constant(value="{") |
||
| 91 | constant(value="\"timestamp\":\"") property(name="timereported" dateFormat="rfc3339") |
||
| 92 | constant(value="\",\"message\":\"") property(name="msg") |
||
| 93 | constant(value="\",\"host\":\"") property(name="hostname") |
||
| 94 | constant(value="\",\"severity\":\"") property(name="syslogseverity-text") |
||
| 95 | constant(value="\",\"facility\":\"") property(name="syslogfacility-text") |
||
| 96 | constant(value="\",\"syslogtag\":\"") property(name="syslogtag") |
||
| 97 | constant(value="\",\"programname\":\"") property(name="programname") |
||
| 98 | constant(value="\",\"procid\":\"") property(name="procid") |
||
| 99 | constant(value="\"}") |
||
| 100 | } |
||
| 101 | |||
| 102 | action( |
||
| 103 | type="omelasticsearch" |
||
| 104 | server="127.0.0.1" |
||
| 105 | serverport="9200" |
||
| 106 | 4 | Константин Пильник | usehttps="off" |
| 107 | 1 | Константин Пильник | uid="elastic" |
| 108 | pwd="mypass1" |
||
| 109 | template="elastic_msg_template" |
||
| 110 | dynSearchIndex="on" |
||
| 111 | searchIndex="elastic_date_template" |
||
| 112 | 2 | Константин Пильник | searchType="rsyslog" |
| 113 | 1 | Константин Пильник | bulkmode="on" |
| 114 | maxbytes="100m" |
||
| 115 | queue.type="linkedlist" |
||
| 116 | queue.size="5000" |
||
| 117 | queue.dequeuebatchsize="300" |
||
| 118 | action.resumeretrycount="-1" |
||
| 119 | ) |
||
| 120 | </code></pre> |