Graylog高级使用
Graylog解析Nginx日志
数据流向:Filebeat->Collector->Filebeat-Graylog Server
创建一个Beats类型的Inputs
system/overview-Inputs
配置Collector收集日志
system/overview-Collector-Mange Configurations-Create configration
修改配置-Create Output-Filebeat Output
修改配置-Create Input-Filebeat Input,记得修改Nginx日志文件路径
修改标签
Collector配置
- 安装collector
wget https://github.com/Graylog2/collector-sidecar/releases/download/0.1.7/collector-sidecar-0.1.7-1.x86_64.rpm
rpm -ivh collector-sidecar-0.1.7-1.x86_64.rpm
- 配置collector
vim /etc/graylog/collector-sidecar/collector_sidecar.yml
# 修改tag标签就好了
- 启动collector
graylog-collector-sidecar install
配置解析IP
- 下载解析文件
# 解压并存放文件到指定路径
tar -xf GeoLite2-City.tar.gz
mv GeoLite2-City_20181218/GeoLite2-City.mmdb /etc/graylog/server/
tar -xf GeoLite2-Country.tar.gz
mv GeoLite2-Country_20181218/GeoLite2-Country.mmdb /etc/graylog/server/
- 修改Inputs的Manage Extractors
Add extractor-Load Message(备注:再次之前,必须保证你的Ningx日志文件中有日志信息)
在message的右侧,选择Select extractor tyep为Grok Pattern
- 配置解析库 system/overview-Configurations-Geo-Location Processor
点击update
效果图