Nginx解析のためのLokiとPromtailの設定方法

Nginxから情報をLokiに移す

Loki,Promtailのインストール方法

私は，公式の導入手順を参考にインストールしました．
バージョンの違いなどもありますので，以下のリンクから公式の導入手順を確認して導入してください．

一応私が導入した時点の内容の一部を置いておきます．

Install using APT or RPM package manager

sudo apt-get update
sudo apt-get install loki promtail

Install manually

cd /usr/local/bin

# arm64 (Raspberry Pi 4 / 5 など)
sudo wget https://github.com/grafana/loki/releases/latest/download/loki-linux-arm64.zip

# amd64 (PC / サーバ)
# sudo wget https://github.com/grafana/loki/releases/latest/download/loki-linux-amd64.zip

Promtailの設定

以下に自分が使用しているPromtailの設定の簡易版を置いておきます．
/etc/promtail/config.ymlにある,Promtailの設定の中身をそのまま書き換えれば，動くようになっています．
この時，Nginxのアクセスログはjsonで書かれていることを前提としています．
Nginxのアクセスログをjson形式にする方法は前の記事に乗せていますので，ぜひそちらを参考にしてください．

# Promtailの設定
-----------------------------------------------------------------------
# This minimal config scrape only single log file.
# Primarily used in rpm/deb packaging where promtail service can be started during system init process.
# And too much scraping during init process can overload the complete system.
# https://github.com/grafana/loki/issues/11398
-----------------------------------------------------------------------


server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /var/lib/promtail/positions.yaml

clients:
  - url: http://localhost:3100/loki/api/v1/push

scrape_configs:
  - job_name: nginx
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx
          host: nginx01
          agent: promtail
          __path__: /var/log/nginx/access.log

    pipeline_stages:

# ログを JSON として解析
      - json:
          expressions:
            msec: msec
            connection: connection
            connection_requests: connection_requests
            pid: pid
            request_id: request_id
            request_length: request_length
            remote_addr: remote_addr
            remote_user: remote_user
            remote_port: remote_port
            time_local: time_local
            time_iso8601: time_iso8601
            request: request
            request_uri: request_uri
            args: args
            status: status
            body_bytes_sent: body_bytes_sent
            bytes_sent: bytes_sent
            http_referer: http_referer
            http_user_agent: http_user_agent
            http_x_forwarded_for: http_x_forwarded_for
            http_host: http_host
            server_name: server_name
            request_time: request_time
            upstream: upstream
            upstream_connect_time: upstream_connect_time
            upstream_header_time: upstream_header_time
            upstream_response_time: upstream_response_time
            upstream_response_length: upstream_response_length
            upstream_cache_status: upstream_cache_status
            ssl_protocol: ssl_protocol
            ssl_cipher: ssl_cipher
            scheme: scheme
            request_method: request_method
            server_protocol: server_protocol
            pipe: pipe
            gzip_ratio: gzip_ratio
            http_cf_ray: http_cf_ray

# Grafana の検索や集計に使うラベル化
      - labels:
          remote_addr:
          status:
          request_uri:
          request_method:
          http_user_agent:
          server_name:

コードを書き込んだら，以下のコマンドにてPromtailにエラーが出ていないかを確認してください．

sudo systemctl restart promtail
sudo systemctl status promtail
sudo journalctl -u promtail -f

エラーが出なければ成功です．
ここまでくれば，あとはGrafanaなどで解析結果を表示するだけです．
次回は，GrafanaにてNginxから出したログで画面を表示していきます．

追記

基本的に必要ないとは思いますが，自分が使用したlokiの設定を置いておきます．
ファイルの場所は/etc/loki/config.ymlでした．

auth_enabled: false

server:
  http_listen_port: 3100
  grpc_listen_port: 9096
  log_level: debug
  grpc_server_max_concurrent_streams: 1000

common:
  instance_addr: 127.0.0.1
  path_prefix: /tmp/loki
  storage:
    filesystem:
      chunks_directory: /tmp/loki/chunks
      rules_directory: /tmp/loki/rules
  replication_factor: 1
  ring:
    kvstore:
      store: inmemory

query_range:
  results_cache:
    cache:
      embedded_cache:
        enabled: true
        max_size_mb: 100

limits_config:
  metric_aggregation_enabled: true
  enable_multi_variant_queries: true

schema_config:
  configs:
    - from: 2020-10-24
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h

pattern_ingester:
  enabled: true
  metric_aggregation:
    loki_address: localhost:3100

ruler:
  alertmanager_url: http://localhost:9093

frontend:
  encoding: protobuf


# By default, Loki will send anonymous, but uniquely-identifiable usage and configuration
# analytics to Grafana Labs. These statistics are sent to https://stats.grafana.org/
#
# Statistics help us better understand how Loki is used, and they show us performance
# levels for most users. This helps us prioritize features and documentation.
# For more information on what's sent, look at
# https://github.com/grafana/loki/blob/main/pkg/analytics/stats.go
# Refer to the buildReport method to see what goes into a report.
#
# If you would like to disable reporting, uncomment the following lines:
#analytics:
#  reporting_enabled: false