Logstash - NGINX and HTTPD logs

Hey!

I’m not @manicas, but hopefully I can help! First of all, I’d suggest you take a look at the second part of his series: Adding Logstash Filters To Improve Centralized Logging It specifically covers Nginx and Apache logs.

Generally, there are two main pieces to getting a log from the server being monitored to the ELK server. Using Nginx as an example, you need to add a new entry to the the “files” section of /etc/logstash-forwarder

,
    {
      "paths": [
        "/var/log/nginx/access.log"
       ],
      "fields": { "type": "nginx-access" }
    }

This tells the logstash-forwarder to send /var/log/nginx/access.log to the ELK instance.

One the other end, you’d need to create a filter telling logstash how to parse the file. The tutorial give an example.

This site can come in very useful when writing filters: https://grokdebug.herokuapp.com/