Проект

Общее

Профиль

Редактировать История

Wiki »

Rsyslog » История » Версия 7

Константин Пильник, 2022-12-01 17:12

1 5 Константин Пильник 
h1. nginx -> rsyslog -> rsyslog-elasticsearch -> elasticsearch
2 





    3
    6
    Константин Пильник
    
apt install rsyslog-elasticsearch





    4
    
    
    





    5
    5
    Константин Пильник
    
<pre><code class="perl">





    6
    
    
    
module(load="omelasticsearch")





    7
    
    
    
module(load="mmjsonparse")





    8
    
    
    





    9
    
    
    
template(name="template_nginx_yyyy_mm_dd" type="list") {





    10
    
    
    
	constant(value="nginx-")





    11
    
    
    
	property(name="timereported" dateformat="year")





    12
    
    
    
	constant(value=".")





    13
    
    
    
	property(name="timereported" dateformat="month")





    14
    
    
    
	constant(value=".")





    15
    
    
    
	property(name="timereported" dateformat="day")





    16
    
    
    
}





    17
    
    
    





    18
    
    
    
template(name="template_msg_to_json" type="list") {





    19
    
    
    
	property(name="$!msg")





    20
    
    
    
}





    21
    
    
    





    22
    
    
    
if ($programname == "nginx") then {





    23
    
    
    
	action(type="mmjsonparse")





    24
    
    
    
	action(type="omelasticsearch"





    25
    
    
    
		server=["https://es1.domain.tld:443", "https://es2.domain.tld:443", "https://es3.domain.tld:443"]





    26
    
    
    
		uid="elastic"





    27
    
    
    
		pwd="secret"





    28
    
    
    
		template="template_msg_to_json"





    29
    
    
    
		dynSearchIndex="on"





    30
    
    
    
		searchIndex="template_nginx_yyyy_mm_dd"





    31
    
    
    
		searchType="nginx"





    32
    
    
    
		bulkmode="on"





    33
    
    
    
		maxbytes="100m"





    34
    
    
    
		queue.type="linkedlist"





    35
    
    
    
		queue.size="5000"





    36
    
    
    
		queue.dequeuebatchsize="300"





    37
    
    
    
		action.resumeretrycount="-1"





    38
    
    
    
	)





    39
    
    
    
}





    40
    
    
    
</code></pre>





    41
    
    
    





    42
    
    
    
h4. nginx/conf.d/log_format.conf





    43
    
    
    





    44
    1
    Константин Пильник
    
# access_log syslog:server=unix:/dev/log,tag=nginx,nohostname default_json;





    45
    7
    Константин Пильник
    





    46
    
    
    
<pre><code class="perl">





    47
    5
    Константин Пильник
    
log_format default_json escape=json





    48
    
    
    
	'{'





    49
    
    
    
		'"args":"$args",'





    50
    
    
    
		'"bytes_sent":"$bytes_sent",'





    51
    
    
    
		'"connection": "$connection",'





    52
    
    
    
		'"connection_requests": "$connection_requests",'





    53
    
    
    
		'"hostname": "$hostname",'





    54
    
    
    
		'"http_referrer":"$http_referer",'





    55
    
    
    
		'"http_user_agent":"$http_user_agent",'





    56
    
    
    
		'"remote_addr":"$remote_addr",'





    57
    
    
    
		'"remote_port":"$remote_port",'





    58
    
    
    
		'"remote_user":"$remote_user",'





    59
    
    
    
		'"request":"$request",'





    60
    
    
    
		'"request_length":"$request_length",'





    61
    
    
    
		'"request_method":"$request_method",'





    62
    
    
    
		'"request_time":"$request_time",'





    63
    
    
    
		'"scheme": "$scheme",'





    64
    
    
    
		'"server_name": "$server_name",'





    65
    
    
    
		'"server_protocol": "$server_protocol",'





    66
    
    
    
		'"status": "$status",'





    67
    
    
    
		'"time_local":"$time_iso8601",'





    68
    
    
    
		'"upstream_addr": "$upstream_addr",'





    69
    
    
    
		'"upstream_response_time": "$upstream_response_time",'





    70
    
    
    
		'"upstream_status": "$upstream_status",'





    71
    
    
    
		'"uri": "$uri"'





    72
    
    
    
	'}';





    73
    
    
    
</code></pre>





    74
    
    
    





    75
    1
    Константин Пильник
    
h1. rsyslog -> elasticsearch





    76
    
    
    





    77
    
    
    
<pre><code class="perl">





    78
    
    
    
# elasticsearch





    79
    
    
    
module(load="omelasticsearch")





    80
    
    
    
template(name="elastic_date_template" type="list") {





    81
    
    
    
	constant(value="rsyslog-")





    82
    
    
    
	property(name="timereported" dateformat="year")





    83
    
    
    
	constant(value=".")





    84
    
    
    
	property(name="timereported" dateformat="month")





    85
    
    
    
	constant(value=".")





    86
    
    
    
	property(name="timereported" dateformat="day")





    87
    
    
    
}





    88
    
    
    





    89
    
    
    
template(name="elastic_msg_template" type="list" option.json="on") {





    90
    
    
    
	constant(value="{")





    91
    
    
    
	constant(value="\"timestamp\":\"")      property(name="timereported" dateFormat="rfc3339")





    92
    
    
    
	constant(value="\",\"message\":\"")     property(name="msg")





    93
    
    
    
	constant(value="\",\"host\":\"")        property(name="hostname")





    94
    
    
    
	constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")





    95
    
    
    
	constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")





    96
    
    
    
	constant(value="\",\"syslogtag\":\"")   property(name="syslogtag")





    97
    
    
    
	constant(value="\",\"programname\":\"") property(name="programname")





    98
    
    
    
	constant(value="\",\"procid\":\"")      property(name="procid")





    99
    
    
    
	constant(value="\"}")





    100
    
    
    
}





    101
    
    
    





    102
    
    
    
action(





    103
    
    
    
	type="omelasticsearch"





    104
    
    
    
	server="127.0.0.1"





    105
    
    
    
	serverport="9200"





    106
    4
    Константин Пильник
    
	usehttps="off"





    107
    1
    Константин Пильник
    
	uid="elastic"





    108
    
    
    
	pwd="mypass1"





    109
    
    
    
	template="elastic_msg_template"





    110
    
    
    
	dynSearchIndex="on"





    111
    
    
    
	searchIndex="elastic_date_template"





    112
    2
    Константин Пильник
    
	searchType="rsyslog"





    113
    1
    Константин Пильник
    
	bulkmode="on"





    114
    
    
    
	maxbytes="100m"





    115
    
    
    
	queue.type="linkedlist"





    116
    
    
    
	queue.size="5000"





    117
    
    
    
	queue.dequeuebatchsize="300"





    118
    
    
    
	action.resumeretrycount="-1"





    119
    
    
    
)





    120
    
    
    
</code></pre>