Make apache output JSON

Inspired by the logstash cookbook on logging to JSON-format in Apache, I made a similar nginx log_format to make nginx log to Logstash JSON-format as well. The configuration is quite similar to the Apache configuration, but nginx got more sensible variable names. The configuration below needs to be included within the http-context in nginx.

log_format logstash_json '{ "@timestamp": "$time_iso8601", '
                         '"@fields": { '
                         '"remote_addr": "$remote_addr", '
                         '"remote_user": "$remote_user", '
                         '"body_bytes_sent": "$body_bytes_sent", '
                         '"request_time": "$request_time", '
                         '"status": "$status", '
                         '"request": "$request", '
                         '"request_method": "$request_method", '
                         '"http_referrer": "$http_referer", '
                         '"http_user_agent": "$http_user_agent" } }';

Then use something like this in your server configuration.

access_log /var/log/nginx/ logstash_json;

A simple logstash.conf for demo-purposes.

input {
  file {
    path => "/var/log/nginx/"
    type => nginx

    # This format tells logstash to expect 'logstash' json events from the file.
    format => json_event

output {
  stdout { debug => true }

Running the logstash agent gives the following output.

Note: The output is “beautified” with JSONLint.

$ java -jar logstash-1.1.1-monolithic.jar agent -f logstash.conf
        "request"=>"GET /some/url HTTP/1.1",
        "http_user_agent"=>"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1"

Thanks to @jordansissel and @ripienaar for their awesome work on the apache cookbook.

comments powered by Disqus
Blog Logo

Pål-Kristian Hamre



DevOps, Thoughts, Tools and stuff.

Back to Overview