http {
    include       mime.types;
    default_type  application/octet-stream;
    charset  utf-8;
    
    # 原有日志格式，不能注釋或者去掉
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" $request_time';
    # json日志格式
    log_format log_json '{"@timestamp": "$time_local", '
                        '"remote_addr": "$remote_addr", '
                        '"referer": "$http_referer", '
                        '"request": "$request", '
                        '"status": $status, '
                        '"bytes": $body_bytes_sent, '
                        '"agent": "$http_user_agent", '
                        '"x_forwarded": "$http_x_forwarded_for", '
                        '"up_addr": "$upstream_addr",'
                        '"up_host": "$upstream_http_host",'
                        '"up_resp_time": "$upstream_response_time",'
                        '"request_time": "$request_time"'
                        ' }';
 
    access_log  logs/access.log log_json; # 引用日志格式名稱
 
    (省略內(nèi)容)
}

[root@elk-nginx-01 conf]# cd /data/services/nginx/conf/
[root@elk-nginx-01 conf]# pwd
/data/services/nginx/conf
[root@elk-nginx-01 conf]# ll
總用量 72
-rw-r--r-- 1 root root 1077 9月   3 09:45 fastcgi.conf
-rw-r--r-- 1 root root 1077 9月   3 09:45 fastcgi.conf.default
-rw-r--r-- 1 root root 1007 9月   3 09:45 fastcgi_params
-rw-r--r-- 1 root root 1007 9月   3 09:45 fastcgi_params.default
-rw-r--r-- 1 root root 2837 9月   3 09:45 koi-utf
-rw-r--r-- 1 root root 2223 9月   3 09:45 koi-win
-rw-r--r-- 1 root root 5231 9月   3 09:45 mime.types
-rw-r--r-- 1 root root 5231 9月   3 09:45 mime.types.default
-rw-r--r-- 1 root root 3729 9月   3 15:49 nginx.conf
-rw-r--r-- 1 root root 2656 9月   3 13:59 nginx.conf-bak0903
-rw-r--r-- 1 root root 2656 9月   3 09:45 nginx.conf.default
-rw-r--r-- 1 root root  636 9月   3 09:45 scgi_params
-rw-r--r-- 1 root root  636 9月   3 09:45 scgi_params.default
drwxr-xr-x 2 root root  134 9月   3 11:34 sslkeys
-rw-r--r-- 1 root root  664 9月   3 09:45 uwsgi_params
-rw-r--r-- 1 root root  664 9月   3 09:45 uwsgi_params.default
drwxr-xr-x 2 root root   87 9月   3 16:53 vhosts
-rw-r--r-- 1 root root 3610 9月   3 09:45 win-utf
[root@elk-nginx-01 conf]# vim nginx.conf
 
http {
    include       mime.types;
    default_type  application/octet-stream;
    charset  utf-8;
    
    # 原有日志格式，不能注釋
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" $request_time';
    # json日志格式
    log_format json '{"@timestamp": "$time_local", '
                        '"remote_addr": "$remote_addr", '
                        '"referer": "$http_referer", '
                        '"request": "$request", '
                        '"status": $status, '
                        '"bytes": $body_bytes_sent, '
                        '"agent": "$http_user_agent", '
                        '"x_forwarded": "$http_x_forwarded_for", '
                        '"up_addr": "$upstream_addr",'
                        '"up_host": "$upstream_http_host",'
                        '"up_resp_time": "$upstream_response_time",'
                        '"request_time": "$request_time"'
                        ' }';
 
    #導(dǎo)入主機(jī)配置
    include vhosts/*.conf;
 
    (省略內(nèi)容)
}
保存退出！
 
[root@elk-nginx-01 conf]# pwd
/data/services/nginx/conf
[root@elk-nginx-01 conf]# cd vhosts/
[root@elk-nginx-01 vhosts]# ll
總用量 12
-rw-r--r-- 1 yfbkf yfbkf  921 9月   3 15:37 gonggao.conf
-rw-r--r-- 1 yfbkf yfbkf 1482 9月   3 16:50 gongdan.conf
-rw-r--r-- 1 yfbkf yfbkf 1151 9月   3 14:42 gongmo.conf

    log_format json '{"@timestamp":"$time_iso8601",'
                     '"scheme":"$scheme",'
                     '"http_referer":"$http_referer",'
                     '"args":"$args",'
                     '"http_user_agent":"$http_user_agent",'
                     '"remote_addr":"$remote_addr",'
                     '"hoste":"$host",'
                     '"server_name":"$server_name",'
                     '"server_protocol":"$server_protocol",'
                     '"request_method":"$request_method",'
                     '"request_uri":"$request_uri",'
                     '"uri":"$uri",'
                     '"request_length":"$request_length",'
                     '"body_byte_sent": "$body_bytes_sent",'
                     '"request_time":"$request_time",'
                     '"server_addr":"$server_addr",'
                     '"status": $status,'
                     '"bytes_sent":"$bytes_sent",'
                     '"upstream_addr":"$upstream_addr",'
                     '"upstream_status":"$upstream_status",'
                     '"upstream_connect_time":"$upstream_connect_time",'
                     '"upstream_response_time":"$upstream_response_time",'
                     '"request_id":"$request_id"'
                     '}';

可以加上這些：
$request_filename:當(dāng)前請求的文件路徑，由root或alias指令與URI請求生成。
$http_cookie:客戶端cookie信息
$http_host #請求地址，即瀏覽器中你輸入的地址（IP或域名）
$server_port:請求到達(dá)服務(wù)器的端口號。
$connection_requests 當(dāng)前通過一個(gè)連接獲得的請求數(shù)量。

[apps@ngx-ali01 conf]$ cat nginx.conf
user  apps apps;
worker_processes  auto;

error_log /apps/svr/tengine/logs/nginx_error.log error;
pid /apps/svr/tengine/logs/nginx.pid;

worker_rlimit_nofile 65535;

events {
    use epoll;
    worker_connections  65535;
}


http {
      log_format main '{"@timestamp":"$time_iso8601",'
                        '"@source":"$server_addr",'
                        '"idc":"huzhou",'
                        '"http_cookie":"$http_cookie",'
                        '"hostname":"$hostname",'
                        '"ip":"$http_x_forwarded_for",'
                        '"client":"$remote_addr",'
                        '"request_method":"$request_method",'
                        '"scheme":"$scheme",'
                        '"domain":"$server_name",'
                        '"referer":"$http_referer",'
                        '"request":"$request_uri",'
                        '"args":"$args",'
                        '"size":$body_bytes_sent,'
                        '"request_body":"$request_body",'
                        '"status": $status,'
                        '"responsetime":$request_time,'
                        '"upstreamtime":"$upstream_response_time",'
                        '"upstreamaddr":"$upstream_addr",'
                        '"http_user_agent":"$http_user_agent",'
                        '"https":"$https"'
                        '}';

        access_log /apps/svr/tengine/logs/access.log main;

        limit_conn_zone $server_name zone=perserver:10m;
        limit_conn_zone $binary_remote_addr zone=perip:20m;
#       limit_req_zone $rt_filtered_ip zone=qps:10m rate=30r/s;

        include mime.types;
        default_type    application/octet-stram;
        server_tokens   off;
        server_tag      off;
        server_info     off;
        server_names_hash_bucket_size 128;
        sendfile        on;
        keepalive_timeout 65;
        gzip  on;
        gzip_http_version 1.1;
        gzip_vary on;
        gzip_comp_level 6;
        gzip_proxied any;
        gzip_types text/plain  text/css application/json  application/x-javascript text/xml application/xml application/xml+rss text/javascript application/x-shockwave-flash image/png image/x-icon image/gif image/jpeg;
        gzip_buffers 16 8k;
        proxy_temp_path /dev/shm/temp;
        proxy_cache_path /dev/shm/cache levels=2:2:2 keys_zone=cache_go:20m inactive=1d max_size=2g;

        vhost_traffic_status_zone;
        vhost_traffic_status_filter_by_host on;
        include conf.d/*.conf;
        include ztoky_cn/*.conf;
}