15
15

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

nginx のログを fluentdに流す(pattern not match対策)

Posted at

Fluentdを通じてNginxのロッグを一箇所に集中しビジュアルにしたいです。

参考資料にこう書いてあルのは多いです:

<source>
  type tail
  format nginx
  path /var/log/nginx/access.log
  pos_file /var/log/td-agent/nginx-access.pos
  tag nginx.access
</source>```

実はこうしてパータンは認識されていません。(エラーログが出ています)

2015-04-03 10:55:49 +0000 [warn]: pattern not match: "192.168.33.1 - - [03/Apr/2015:10:55:49 +0000] "GET /js/header.js HTTP/1.1" 200 2988 "http://gg.dev.com/\" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" "-""


その**[warn]: pattern not match**はエラーです。

NginxのローグフォーマットはApacheと異なり、そのまま解析できないらしいです。

こう修正すれば問題解消します。

...
pos_file /var/log/td-agent/nginx-access.pos
format /^(?[^ ]) (?[^ ]) (?[^ ]) [(?[^\]])] "(?\S+)(?: +(?[^ ]) +\S)?" (?[^ ]) (?[^ ])(?: "(?[^\"])" "(?[^\"])" "(?[^\"]*)")?/
time_format %d/%b/%Y:%H:%M:%S %z
...



参考資料:http://bynatures.net/wordpress/1951/
15
15
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
15
15

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?