ELK收集nginx日志并展示来源IP地图

# 修改日志模式
 # json 为规则名字 escape=json 设置日志文件格式为json
     log_format json escape=json '{"@timestamp":"$time_iso8601",'
                                 '"domain":"$host",'
                                 '"host":"$server_addr",'
                                 '"clientip":"$remote_addr",'
                                 '"remote_user":"$remote_user",'
                                 '"request":"$request",'
                                 '"request_method":"$request_method",'
                                 '"uri":"$uri",'
                                 '"request_time":"$request_time",'
                                 '"status":"$status",'
                                 '"http_referrer":"$http_referer",'
                                 '"body_bytes_sent":"$body_bytes_sent",'
                                 '"xff":"$http_x_forwarded_for",'
                                 '"http_user_agent":"$http_user_agent",'
                                 '"upstream_addr":"$upstream_addr",'
                                 '"upstream_response_time":"$upstream_response_time"}';
 # 将上方的规则名称写到最后
 access_log /var/log/nginx/access.log json;

# 进入工作目录
cd /opt
# 下载GeoLite2数据库
wget https://raw.githubusercontent.com/texnikru/GeoLite2-Database/master/GeoLite2-City.mmdb.gz
# 解压文件
gunzip GeoLite2-City.mmdb.gz
# 将GeoLite2移动到logstash目录下
mv GeoLite2-City.mmdb /usr/local/elk/logstash/config/
# 修改logstash配置文件
vim /usr/local/elk/logstash/default.conf

# 监听5044端口作为输入
input {
 beats {
   port => "5044"
 }
}
# 数据过滤
filter {
 json {
   source => "message"
    remove_field => [ "message" ]
   #删除重复的message收集.
 }
 mutate {
     split => { "request" => " " }
 }
 mutate {
   add_field => {
  "httpversion" => "%{[request][2]}"
   }
 }
 mutate {                           #这里应该是选取xff,这里没有可以删掉,
     split => { "xff" => "," }
 }
 mutate {
   add_field => {
        "realip" => "%{[xff][0]}"
   }
 }
 geoip {
    source => "clientip"
    target => "geoip"
    #填写自己的GeoLite2数据库目录
     database => "/usr/local/elk/logstash/config/GeoLite2-City.mmdb"
    #获取经纬度
    add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"]
    add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"]
 }
 mutate {
   convert => [ "[geoip][coordinates]", "float" ]
 }
}
# 这是ElasticSerach服务的监听端口
output {
 elasticsearch {
   hosts => ["192.168.10.129:9200"]
   index =>  "nginx-%{+YYYY.MM.dd}"
   #根据项目名称动态创建索引
 }
}