nginx_access_khachhang.conf

input{
    file {
        path => ["/var/log/nginx/khachhang.giaohangtietkiem.vn.access.log"]
                sincedb_path => "/usr/share/logstash/data/plugins/inputs/file/nginx_access_khachhang.sincedb"
                ignore_older => 30
                start_position => "end"
    }
        file {
        path => ["/var/log/nginx/services.giaohangtietkiem.vn.access.log"]
                sincedb_path => "/usr/share/logstash/data/plugins/inputs/file/nginx_access_service.sincedb"
                ignore_older => 30
                start_position => "end"
    }
}

filter{
    grok {
        match => {
            "message" => "%{IP:remote_ip} - %{IP:client_ip} \[(?<timestamp>%{MONTHDAY}[./]%{MONTH}[./]%{YEAR}[:]%{TIME} %{ISO8601_TIMEZONE})\] \"%{WORD:method} %{DATA:url} HTTP/%{NUMBER:http_version:float}\" %{POSINT:response_code:int} %{POSINT:bytes:int} \"%{DATA:referrer}\" \"%{DATA:agent}\" rt=%{NUMBER:rt:float} uct=%{NUMBER:uct:float} uht=%{NUMBER:uht:float} urt=%{NUMBER:urt:float}"
        }
    }
        if "_grokparsefailure" not in [tags] {
            grok {
                match => {"url" => "(^\/customer\/js\/|^\/customer\/css\/|^\/customer\/img\/|^\/admin\/js\/|^\/admin\/files\/uploads\/|^\/wp-content\/|^\/wp-includes\/|^\/wp-admin\/css\/|^\/wp-admin\/js\/|^\/wp-admin\/images\/|^\/cache_js\/|^\/cache_css\/|\.js$|\.css$|\.png$|\.jpg$)"}
                tag_on_failure => ["_is_not_resources"]
            }

            # Drop resources request (js, css, images, font ...)
            if "_is_not_resources" not in [tags] {
                drop {}
            }

            grok {
                match => {"url" => "%{URIPATH:uri_path}(%{URIPARAM:uri_param})?" }
            }

            date {
                match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
                target => "log_timestamp"
                        remove_tag => ["_is_not_resources"]
            }

            geoip {
                source => "client_ip"
                remove_field => [ "timestamp", "message"]
            }
        }

        else{
            drop {}
        }
}

output {
    elasticsearch {
        hosts => ["10.10.2.207:9200"]
        index => "nginx_access_log-%{+YYYY.MM.dd}"
    }
}