| 1 | # Netdata log2journal Configuration |
| 2 | # The following parses nginx log files using the combined format. |
| 3 | |
| 4 | # The PCRE2 pattern to match log entries and give names to the fields. |
| 5 | # The journal will have these names, so follow their rules. You can |
| 6 | # initiate an extended PCRE2 pattern by starting the pattern with (?x) |
| 7 | pattern: | |
| 8 | (?x) # Enable PCRE2 extended mode |
| 9 | ^ |
| 10 | (?<NGINX_REMOTE_ADDR>[^ ]+) \s - \s # NGINX_REMOTE_ADDR |
| 11 | (?<NGINX_REMOTE_USER>[^ ]+) \s # NGINX_REMOTE_USER |
| 12 | \[ |
| 13 | (?<NGINX_TIME_LOCAL>[^\]]+) # NGINX_TIME_LOCAL |
| 14 | \] |
| 15 | \s+ " |
| 16 | (?<NGINX_REQUEST> |
| 17 | (?<NGINX_REQUEST_METHOD>[A-Z]+) \s+ # NGINX_METHOD |
| 18 | (?<NGINX_REQUEST_URI>[^ ]+) \s+ |
| 19 | (?<NGINX_SERVER_PROTOCOL>[^"]+) |
| 20 | ) |
| 21 | " \s+ |
| 22 | (?<NGINX_STATUS>\d+) \s+ # NGINX_STATUS |
| 23 | (?<NGINX_BODY_BYTES_SENT>\d+) \s+ # NGINX_BODY_BYTES_SENT |
| 24 | "(?<NGINX_HTTP_REFERER>[^"]*)" \s+ # NGINX_HTTP_REFERER |
| 25 | "(?<NGINX_HTTP_USER_AGENT>[^"]*)" # NGINX_HTTP_USER_AGENT |
| 26 | |
| 27 | # When log2journal can detect the filename of each log entry (tail gives it |
| 28 | # only when it tails multiple files), this key will be used to send the |
| 29 | # filename to the journals. |
| 30 | filename: |
| 31 | key: NGINX_LOG_FILENAME |
| 32 | |
| 33 | rename: |
| 34 | - new_key: MESSAGE |
| 35 | old_key: NGINX_REQUEST |
| 36 | |
| 37 | # Inject constant fields into the journal logs. |
| 38 | inject: |
| 39 | - key: SYSLOG_IDENTIFIER |
| 40 | value: nginx-log |
| 41 | |
| 42 | # inject PRIORITY is a duplicate of NGINX_STATUS |
| 43 | - key: PRIORITY |
| 44 | value: '${NGINX_STATUS}' |
| 45 | |
| 46 | # Inject NGINX_STATUS_FAMILY is a duplicate of NGINX_STATUS |
| 47 | - key: NGINX_STATUS_FAMILY |
| 48 | value: '${NGINX_STATUS}' |
| 49 | |
| 50 | # Rewrite the value of fields (including the duplicated ones). |
| 51 | # The search pattern can have named groups, and the replace pattern can use |
| 52 | # them as ${name}. |
| 53 | rewrite: |
| 54 | # PRIORITY is a duplicate of NGINX_STATUS |
| 55 | # Valid PRIORITIES: 0=emerg, 1=alert, 2=crit, 3=error, 4=warn, 5=notice, 6=info, 7=debug |
| 56 | - key: PRIORITY |
| 57 | match: '^[123]' |
| 58 | value: 6 |
| 59 | |
| 60 | - key: PRIORITY |
| 61 | match: '^4' |
| 62 | value: 5 |
| 63 | |
| 64 | - key: PRIORITY |
| 65 | match: '^5' |
| 66 | value: 3 |
| 67 | |
| 68 | - key: PRIORITY |
| 69 | match: '.*' |
| 70 | value: 4 |
| 71 | |
| 72 | # NGINX_STATUS_FAMILY is a duplicate of NGINX_STATUS |
| 73 | - key: NGINX_STATUS_FAMILY |
| 74 | match: '^(?<first_digit>[1-5])' |
| 75 | value: '${first_digit}xx' |
| 76 | |
| 77 | - key: NGINX_STATUS_FAMILY |
| 78 | match: '.*' |
| 79 | value: 'UNKNOWN' |
| 80 | |
| 81 | # Control what to do when input logs do not match the main PCRE2 pattern. |
| 82 | unmatched: |
| 83 | # The journal key to log the PCRE2 error message to. |
| 84 | # Set this to MESSAGE, so you to see the error in the log. |
| 85 | key: MESSAGE |
| 86 | |
| 87 | # Inject static fields to the unmatched entries. |
| 88 | # Set PRIORITY=1 (alert) to help you spot unmatched entries in the logs. |
| 89 | inject: |
| 90 | - key: PRIORITY |
| 91 | value: 1 |