{"action":"closed","issue":{"url":"https://api.github.com/repos/deviantony/docker-elk/issues/27","labels_url":"https://api.github.com/repos/deviantony/docker-elk/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/deviantony/docker-elk/issues/27/comments","events_url":"https://api.github.com/repos/deviantony/docker-elk/issues/27/events","html_url":"https://github.com/deviantony/docker-elk/issues/27","id":120128676,"number":27,"title":"In logstash.conf i likely to use nginx access.log file.Now how to check the output.","user":{"login":"veeruborra","id":12707693,"avatar_url":"https://avatars.githubusercontent.com/u/12707693?v=3","gravatar_id":"","url":"https://api.github.com/users/veeruborra","html_url":"https://github.com/veeruborra","followers_url":"https://api.github.com/users/veeruborra/followers","following_url":"https://api.github.com/users/veeruborra/following{/other_user}","gists_url":"https://api.github.com/users/veeruborra/gists{/gist_id}","starred_url":"https://api.github.com/users/veeruborra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/veeruborra/subscriptions","organizations_url":"https://api.github.com/users/veeruborra/orgs","repos_url":"https://api.github.com/users/veeruborra/repos","events_url":"https://api.github.com/users/veeruborra/events{/privacy}","received_events_url":"https://api.github.com/users/veeruborra/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-12-03T09:40:28Z","updated_at":"2015-12-14T06:18:05Z","closed_at":"2015-12-14T06:18:05Z","body":"```\r\n//--gork filter\r\n\r\nNGINX_ACCESS %{IPORHOST:remote_addr} - %{USERNAME:remote_user} \\[%{HTTPDATE:time_local}\\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}\r\n```\r\n\r\n```\r\n//--------------logstash.conf\r\ninput {\r\n\r\n  file {\r\n    type => \"nginx\"\r\n    start_position => \"beginning\"\r\n    path => [ \"/var/log/nginx/access.log\" ]\r\n  }\r\n}\r\nfilter {\r\n  if [type] == \"nginx\" {\r\n    grok {\r\n\tpatterns_dir => \"/etc/logstash/patterns\"\r\n\tmatch => { \"message\" => \"%{NGINX_ACCESS}\" }\r\n\tremove_tag => [\"_grokparsefailure\"]\r\n\tadd_tag => [\"nginx_access\"]\r\n    }\r\n \r\n    geoip {\r\n      source => \"remote_addr\"\r\n    }\r\n  }\r\n}\r\n\r\n\r\noutput {\r\n\telasticsearch {\r\n\t\t\r\n\t\thosts => \"elasticsearch:9200\"\r\n\t}\r\n         \r\n}\r\n```"}}