filebeat 解析json日志

filebeat配置

- input_type: log
  paths:
    - /var/log/nginx/nginx.log
  fields:
    host.name: 192.159.60.71
    fields_under_root: true
    service: nginx
    tags: test
  processors:
    - decode_json_fields:
        fields: ['message']
        target: ""
        overwrite_keys: false
        process_array: false
        max_depth: 1
    - drop_fields:
        fields: ["message", "ecs", "agent", "log"] #删除不要的信息
    - dissect:
        tokenizer: "%{request_time|float}"  #更改耗时的数据类型，改为浮点数，可进行计算
        field: "request_time"
        target_prefix: "dissect" #可有可无

nginx配置

     log_format log_json '{"@timestamp": "$time_local", '
                        '"remote_addr": "$remote_addr", '
                        '"referer": "$http_referer", '
                        '"request": "$request", '
                        '"url": "$uri",'
                        '"method": "$request_method",'
                        '"status": "$status", '
                        '"bytes": "$body_bytes_sent", '
                        '"agent": "$http_user_agent", '
                        '"x_forwarded": "$http_x_forwarded_for", '
                        '"up_addr": "$upstream_addr",'
                        '"up_host": "$upstream_http_host",'
                        '"up_resp_time": "$upstream_response_time",'
                        '"request_time": "$request_time"'
                        ' }';
  access_log  /var/log/nginx/nginx.log log_json;