zh/2023-10-29-collect-and-analyse-nginx-accesslog-by-lal/index.html - skywalking-website - Git at Google

 <!doctype html>
 <html lang="en" class="no-js">
   <head>
     <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 <meta name="twitter:site" content="skywalking.apache.org">
 <meta name="twitter:image:src" content="https://skywalking.apache.org/images/skywalking_400x400.png">
 <meta property="og:image" content="https://skywalking.apache.org/images/skywalking_400x400.png">

 <meta name="generator" content="Hugo 0.80.0" />


 <script async src="https://www.googletagmanager.com/gtag/js?id=G-GR8N6PGRJ3"></script>
 <script>
   window.dataLayer = window.dataLayer || [];
   function gtag(){dataLayer.push(arguments);};
   gtag('js', new Date());gtag('config', 'G-GR8N6PGRJ3');
 </script>
 <META NAME="ROBOTS" CONTENT="INDEX, FOLLOW">
 <link rel="stylesheet" href="//at.alicdn.com/t/c/font_3007530_pvozs1rz2wn.css">


 <link rel="apple-touch-icon" sizes="180x180" href="/favicons/apple-touch-icon.png">
 <link rel="icon" type="image/png" sizes="32x32" href="/favicons/favicon-32x32.png">
 <link rel="icon" type="image/png" sizes="16x16" href="/favicons/favicon-16x16.png">
 <link rel="manifest" href="/favicons/site.webmanifest">
 <link rel="mask-icon" href="/favicons/safari-pinned-tab.svg" color="#5bbad5">
 <meta name="msapplication-TileColor" content="#da532c">
 <meta name="theme-color" content="#ffffff">

 <title>使用 LAL 收集并分析 Nginx access log | Apache SkyWalking</title><meta property="og:title" content="使用 LAL 收集并分析 Nginx access log" />
 <meta property="og:description" content="本篇文章演示如何将 Nginx access log 收集到 SkyWalking 中，并通过 LAL 进行指标分析" />
 <meta property="og:type" content="article" />
 <meta property="og:url" content="/zh/2023-10-29-collect-and-analyse-nginx-accesslog-by-lal/" />
 <meta property="article:published_time" content="2023-10-29T00:00:00+00:00" />
 <meta property="article:modified_time" content="2024-06-19T08:45:12+08:00" />
 <meta itemprop="name" content="使用 LAL 收集并分析 Nginx access log">
 <meta itemprop="description" content="本篇文章演示如何将 Nginx access log 收集到 SkyWalking 中，并通过 LAL 进行指标分析">
 <meta itemprop="datePublished" content="2023-10-29T00:00:00+00:00" />
 <meta itemprop="dateModified" content="2024-06-19T08:45:12+08:00" />
 <meta itemprop="wordCount" content="290">


 <meta itemprop="keywords" content="LAL,Logging,Nginx," />
 <meta name="twitter:card" content="summary"/>
 <meta name="twitter:title" content="使用 LAL 收集并分析 Nginx access log"/>
 <meta name="twitter:description" content="本篇文章演示如何将 Nginx access log 收集到 SkyWalking 中，并通过 LAL 进行指标分析"/>


 <link rel="preload" href="/scss/main.min.592235942cb3c9f3dd697382a4e7a1fad8e1c182dad2841bdce6b43b4a346ae8.css" as="style">
 <link href="/scss/main.min.592235942cb3c9f3dd697382a4e7a1fad8e1c182dad2841bdce6b43b4a346ae8.css" rel="stylesheet" integrity="">


 <link rel="stylesheet" href="/css/docSearch.css" />


 <script src="/js/jquery-3.6.0.min.js"></script>


     <title>使用 LAL 收集并分析 Nginx access log | Apache SkyWalking</title>
   </head>
   <body class="td-page td-blog">
     <header>

 <nav class="js-navbar-scroll navbar navbar-expand  flex-column flex-md-row td-navbar">
     <div class="sidebar-button">
       <i class="iconfont icon-menu"></i>
     </div>
     <a class="navbar-brand" href="/">
         <span class="navbar-logo"><img width="130" src="/images/logo.svg" alt="SkyWalking"></span>
     </a>
     <div class="td-navbar-nav-scroll navbar-nav-wrapper" id="navigation">
         <ul class="navbar-nav mt-lg-0">


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/docs" ><span>Projects and Docs</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/events" ><span>Events</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/blog" ><span>Blogs</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/downloads" ><span>Downloads</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/team" ><span>Team</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">


 				<a class="nav-link" href="/users" ><span>Users</span></a>
 			</li>


             <li class="nav-item mr-3 mb-lg-0">
                 <span class="link dropdown blog">
                     <a class="link-name nav-link dropdown-toggle" href="#" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">中文资料</a>
                     <div class="dropdown-menu">
                         <a class="dropdown-item" href="/zh/">博客</a>
                         <a class="dropdown-item" href="https://space.bilibili.com/390683219" target="_blank" rel="noopener noreferrer">
                             B站
                         </a>
                         <a class="dropdown-item" href="https://juejin.cn/user/13673577331607" target="_blank" rel="noopener noreferrer">
                             掘金
                         </a>
                     </div>
                 </span>
             </li>


         </ul>
     </div>
     <div class="navbar-nav d-none d-lg-block search-input-box">


             <span class="link dropdown">
                 <a class="link-name dropdown-toggle" href="#" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                     Links
                 </a>
                 <div class="dropdown-menu">

                     <a class="dropdown-item" href="http://www.apache.org/">Apache Software Foundation</a>
                     <a class="dropdown-item" href="https://github.com/apache/skywalking/issues">GitHub Issue Tracker</a>
                     <a class="dropdown-item" href="https://github.com/apache/skywalking/discussions">Discussion</a>
                     <a class="dropdown-item" href="https://lists.apache.org/list.html?dev@skywalking.apache.org">Dev Mailing List</a>
                     <a class="dropdown-item" href="https://cwiki.apache.org/confluence/display/SKYWALKING/Home">WIKI</a>
                     <a class="dropdown-item" href="http://www.apache.org/licenses/">License</a>
                     <a class="dropdown-item" href="http://www.apache.org/events/current-event">Apache Events</a>
                     <a class="dropdown-item" href="http://www.apache.org/security/">Security</a>
                     <a class="dropdown-item" href="http://www.apache.org/foundation/sponsorship.html">Sponsor and Donate</a>
                     <a class="dropdown-item" href="http://www.apache.org/foundation/thanks.html">Thanks</a>
                     <a class="dropdown-item" href="https://apache.org/foundation/policies/privacy.html">Privacy</a>
                 </div>
             </span>


 <div id="docsearch"></div>


     </div>
 </nav>

     </header>
     <div class="container-fluid td-outer">
       <div class="td-main">
         <div class="row container container-center">
           <main class="col-12 col-md-12 col-xl-10 pl-md-4 pr-md-4" role="main">

 <div class="td-content">
 	<h1>使用 LAL 收集并分析 Nginx access log</h1>
 	<div class="lead">本篇文章演示如何将 Nginx access log 收集到 SkyWalking 中，并通过 LAL 进行指标分析</div>
 	<div class="td-byline mb-4">
 		By <b>魏翔</b> |
 		<time datetime="2023-10-29" class="text-muted">Sunday, October 29, 2023</time>


 	</div>
 	<h2 id="背景介绍">背景介绍</h2>
 <p>Nginx access log 中包含了丰富的信息，例如：日志时间、状态码、响应时间、body 大小等。通过收集并分析 access log，我们可以实现对 Nginx 中接口状态的监控。</p>
 <p>在本案例中，将由 <a href="https://fluentbit.io/">fluent-bit</a> 收集 access log，并通过 HTTP 将日志信息发送给 SkyWalking OAP Server 进行进一步的分析。</p>
 <h2 id="环境准备">环境准备</h2>
 <p>实验需要的 Nginx 及 Fluent-bit 相关配置文件都被上传到了<a href="https://github.com/weixiang1862/nginx-fluent-bit">Github</a>，有需要的读者可以自行 git clone 并通过 docker compose 启动，本文中将介绍配置文件中几个关键点。</p>
 <h3 id="nginx日志格式配置">Nginx日志格式配置</h3>
 <p>LAL 目前支持 JSON、YAML 及 REGEX 日志解析，为了方便获取到日志中的指标字段，我们将 Nginx 的日志格式定义为 JSON.</p>
 <pre><code>http {
     ...
     ...

     log_format  main  '{&quot;remote_addr&quot;: &quot;$remote_addr&quot;,'
             '&quot;remote_user&quot;: &quot;$remote_user&quot;,'
             '&quot;request&quot;: &quot;$request&quot;,'
             '&quot;time&quot;: &quot;$time_iso8601&quot;,'
             '&quot;status&quot;: &quot;$status&quot;,'
             '&quot;request_time&quot;:&quot;$request_time&quot;,'
             '&quot;body_bytes_sent&quot;: &quot;$body_bytes_sent&quot;,'
             '&quot;http_referer&quot;: &quot;$http_referer&quot;,'
             '&quot;http_user_agent&quot;: &quot;$http_user_agent&quot;,'
             '&quot;http_x_forwarded_for&quot;: &quot;$http_x_forwarded_for&quot;}';

     access_log  /var/log/nginx/access.log  main;

     ...
     ...
 }
 </code></pre><h3 id="fluent-bit-filter">Fluent bit Filter</h3>
 <p>我们通过 Fluent bit 的 lua filter 进行日志格式的改写，将其调整为 SkyWalking 所需要的格式，record的各个字段含义如下：</p>
 <ul>
 <li>body：日志内容体</li>
 <li>service：服务名称</li>
 <li>serviceInstance：实例名称</li>
 </ul>
 <pre><code>function rewrite_body(tag, timestamp, record)
     local newRecord = {}
     newRecord[&quot;body&quot;] = { json = { json = record.log } }
     newRecord[&quot;service&quot;] = &quot;nginx::nginx&quot;
     newRecord[&quot;serviceInstance&quot;] = &quot;localhost&quot;
     return 1, timestamp, newRecord
 end
 </code></pre><h2 id="oap-日志分析">OAP 日志分析</h2>
 <h3 id="lal定义">LAL定义</h3>
 <p>在 filter 中，我们通过条件判断，只处理 <code>service=nginx::nginx</code> 的服务，其他服务依旧走默认逻辑：</p>
 <p>第一步，使用 json 指令对日志进行解析，解析的结果会被存放到 parsed 字段中，通过 parsed 字段我们可以获取 json 日志中的字段信息。</p>
 <p>第二步，使用 timestamp 指令解析 parsed.time 并将其赋值给日志的 timestamp 字段，这里的 time 就是access log json 中的 time。</p>
 <p>第三步，使用 tag 指令给日志打上对应的标签，标签的值依然可以通过 parsed 字段获取。</p>
 <p>第四步，使用 metrics 指令从日志中提取出指标信息，我们共提取了四个指标：</p>
 <ul>
 <li><code>nginx_log_count</code>：Nginx 每次请求都会生成一条 access log，该指标可以帮助我们统计 Nginx 当前的请求数。</li>
 <li><code>nginx_request_time</code>：access log 中会记录请求时间，该指标可以帮助我们统计上游接口的响应时长。</li>
 <li><code>nginx_body_bytes_sent</code>：body 大小指标可以帮助我们了解网关上的流量情况。</li>
 <li><code>nginx_status_code</code>：状态码指标可以实现对状态码的监控，如果出现异常上涨可以结合 alarm 进行告警。</li>
 </ul>
 <div class="highlight"><pre style="background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-yaml" data-lang="yaml"><span style="color:#000080">rules</span>:<span style="color:#bbb">
 </span><span style="color:#bbb">  </span>- <span style="color:#000080">name</span>:<span style="color:#bbb"> </span>default<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">layer</span>:<span style="color:#bbb"> </span>GENERAL<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">dsl</span>:<span style="color:#bbb"> </span>|<span style="color:#d14">
 </span><span style="color:#d14">      filter {
 </span><span style="color:#d14">        if (log.service == &#34;nginx::nginx&#34;) {
 </span><span style="color:#d14">          json {
 </span><span style="color:#d14">            abortOnFailure true
 </span><span style="color:#d14">          }</span><span style="color:#bbb">
 </span><span style="color:#bbb">
 </span><span style="color:#bbb">          </span>extractor {<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>timestamp parsed.time as String, &#34;yyyy-MM-dd&#39;T&#39;HH:mm:ssXXX&#34;<span style="color:#bbb">
 </span><span style="color:#bbb">            </span><span style="color:#000080">tag status</span>:<span style="color:#bbb"> </span>parsed.status<span style="color:#bbb">
 </span><span style="color:#bbb">            </span><span style="color:#000080">tag remote_addr</span>:<span style="color:#bbb"> </span>parsed.remote_addr<span style="color:#bbb">
 </span><span style="color:#bbb">
 </span><span style="color:#bbb">            </span>metrics {<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>timestamp log.timestamp as Long<span style="color:#bbb">
 </span><span style="color:#bbb">              </span><span style="color:#000080">labels service: log.service, instance</span>:<span style="color:#bbb"> </span>log.serviceInstance<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>name &#34;nginx_log_count&#34;<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>value 1<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>metrics {<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>timestamp log.timestamp as Long<span style="color:#bbb">
 </span><span style="color:#bbb">              </span><span style="color:#000080">labels service: log.service, instance</span>:<span style="color:#bbb"> </span>log.serviceInstance<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>name &#34;nginx_request_time&#34;<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>value parsed.request_time as Double<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>metrics {<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>timestamp log.timestamp as Long<span style="color:#bbb">
 </span><span style="color:#bbb">              </span><span style="color:#000080">labels service: log.service, instance</span>:<span style="color:#bbb"> </span>log.serviceInstance<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>name &#34;nginx_body_bytes_sent&#34;<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>value parsed.body_bytes_sent as Long<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>metrics {<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>timestamp log.timestamp as Long<span style="color:#bbb">
 </span><span style="color:#bbb">              </span><span style="color:#000080">labels service: log.service, instance: log.serviceInstance, status</span>:<span style="color:#bbb"> </span>parsed.status<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>name &#34;nginx_status_code&#34;<span style="color:#bbb">
 </span><span style="color:#bbb">              </span>value 1<span style="color:#bbb">
 </span><span style="color:#bbb">            </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">          </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">        </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">
 </span><span style="color:#bbb">        </span>sink {<span style="color:#bbb">
 </span><span style="color:#bbb">        </span>}<span style="color:#bbb">
 </span><span style="color:#bbb">      </span>}<span style="color:#bbb">
 </span></code></pre></div><p>经过 LAL 处理后，我们已经可以在日志面板看到日志信息了，接下来我们将对 LAL 中提取的指标进行进一步分析：</p>
 <p><img src="./nginx-log.jpg" alt="nginx-log"></p>
 <h3 id="mal定义">MAL定义</h3>
 <p>在 MAL 中，我们可以对上一步 LAL 中提取的指标进行进一步的分析聚合，下面的例子里：</p>
 <p>nginx_log_count、nginx_request_time、nginx_status_code 使用 sum 聚合函数处理，并使用 SUM 方式 downsampling，</p>
 <p>nginx_request_time 使用 avg 聚合函数求平均值，默认使用 AVG 方式 downsampling。</p>
 <p>完成聚合分析后，SkyWalking Meter System 会完成对上述指标的持久化。</p>
 <div class="highlight"><pre style="background-color:#fff;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-yaml" data-lang="yaml"><span style="color:#000080">expSuffix</span>:<span style="color:#bbb"> </span>service([&#39;service&#39;], Layer.GENERAL)<span style="color:#bbb">
 </span><span style="color:#bbb"></span><span style="color:#000080">metricPrefix</span>:<span style="color:#bbb"> </span>nginx<span style="color:#bbb">
 </span><span style="color:#bbb"></span><span style="color:#000080">metricsRules</span>:<span style="color:#bbb">
 </span><span style="color:#bbb">  </span>- <span style="color:#000080">name</span>:<span style="color:#bbb"> </span>cpm<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">exp</span>:<span style="color:#bbb"> </span>nginx_log_count.sum([&#39;service&#39;]).downsampling(SUM)<span style="color:#bbb">
 </span><span style="color:#bbb">  </span>- <span style="color:#000080">name</span>:<span style="color:#bbb"> </span>avg_request_time<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">exp</span>:<span style="color:#bbb"> </span>nginx_request_time.avg([&#39;service&#39;])<span style="color:#bbb">
 </span><span style="color:#bbb">  </span>- <span style="color:#000080">name</span>:<span style="color:#bbb"> </span>body_bytes_sent_count<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">exp</span>:<span style="color:#bbb"> </span>nginx_body_bytes_sent.sum([&#39;service&#39;]).downsampling(SUM)<span style="color:#bbb">
 </span><span style="color:#bbb">  </span>- <span style="color:#000080">name</span>:<span style="color:#bbb"> </span>status_code_count<span style="color:#bbb">
 </span><span style="color:#bbb">    </span><span style="color:#000080">exp</span>:<span style="color:#bbb"> </span>nginx_status_code.sum([&#39;service&#39;,&#39;status&#39;]).downsampling(SUM)<span style="color:#bbb">
 </span></code></pre></div><p>最后，我们便可以来到 SkyWalking UI 页面新建 Nginx 仪表板，使用刚刚 MAL 中定义的指标信息创建 Nginx Dashboard（也可以通过上文提到<a href="https://github.com/weixiang1862/nginx-fluent-bit">仓库</a>中的 dashboard.json 直接导入测试）：</p>
 <p><img src="./nginx-metric.jpg" alt="nginx-metric"></p>
 <h2 id="参考文档">参考文档</h2>
 <ul>
 <li><a href="https://docs.fluentbit.io/manual/pipeline/filters/lua">Fluent Bit lua Filter</a></li>
 <li><a href="https://skywalking.apache.org/docs/main/next/en/concepts-and-designs/lal/">Log Analysis Language</a></li>
 <li><a href="https://skywalking.apache.org/docs/main/next/en/concepts-and-designs/mal/">Meter Analysis Language</a></li>
 </ul>


 	<ul class="list-unstyled d-flex justify-content-between align-items-center mb-0 pt-5">
   <li>
     <a href="/zh/2023-10-18-skywalking-toolkit-trace/" class="btn btn-primary "><span class="mr-1">←</span> Previous</a>
   </li>
     <a href="/zh/2023-11-09-ospp-summary/" class="btn btn-primary ">Next <span class="ml-1">→</span></a>
   </li>
 </ul>

 </div>


           </main>
           <div class="toc d-none d-xl-block d-md-none col-xl-2 td-toc d-print-none">
             <div class="tags-wrapper">
     <div class="font-weight-bold post-meta ">
         <i class="iconfont icon-tags pr-1" aria-hidden="true"></i>
         Tags
     </div>
     <ul class="tags-box">

         <li>
             <a href="/zh_tags/agent/" class="tag-link">Agent</a>
             <span class="count">3</span>
         </li>

         <li>
             <a href="/zh_tags/apache-shenyu-incubating/" class="tag-link">Apache ShenYu (incubating)</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/conference/" class="tag-link">Conference</a>
             <span class="count">9</span>
         </li>

         <li>
             <a href="/zh_tags/course/" class="tag-link">Course</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/development/" class="tag-link">Development</a>
             <span class="count">3</span>
         </li>

         <li>
             <a href="/zh_tags/dotnetcore/" class="tag-link">DotNetCore</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/ebpf/" class="tag-link">eBPF</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/elasticsearch/" class="tag-link">ElasticSearch</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/java/" class="tag-link">Java</a>
             <span class="count">2</span>
         </li>

         <li>
             <a href="/zh_tags/logging/" class="tag-link">Logging</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/metrics/" class="tag-link">Metrics</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/observability/" class="tag-link">Observability</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/open-source-contribution/" class="tag-link">Open Source Contribution</a>
             <span class="count">4</span>
         </li>

         <li>
             <a href="/zh_tags/open-source-promotion-plan/" class="tag-link">Open Source Promotion Plan</a>
             <span class="count">2</span>
         </li>

         <li>
             <a href="/zh_tags/performance/" class="tag-link">Performance</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/profiling/" class="tag-link">Profiling</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/release-blog/" class="tag-link">Release Blog</a>
             <span class="count">3</span>
         </li>

         <li>
             <a href="/zh_tags/service-mesh/" class="tag-link">Service Mesh</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/shardingsphere/" class="tag-link">ShardingSphere</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/shardingsphere-proxy/" class="tag-link">ShardingSphere-proxy</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/skywalking/" class="tag-link">SkyWalking</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/source-code/" class="tag-link">Source Code</a>
             <span class="count">1</span>
         </li>

         <li>
             <a href="/zh_tags/tracing/" class="tag-link">Tracing</a>
             <span class="count">3</span>
         </li>

         <li>
             <a href="/zh_tags/use-case/" class="tag-link">Use Case</a>
             <span class="count">3</span>
         </li>

         <li>
             <a href="/zh_tags/user-manual/" class="tag-link">User Manual</a>
             <span class="count">16</span>
         </li>

         <li>
             <a href="/zh_tags/video/" class="tag-link">Video</a>
             <span class="count">11</span>
         </li>

         <li>
             <a href="/zh_tags/web-ui/" class="tag-link">Web UI</a>
             <span class="count">1</span>
         </li>

     </ul>
 </div>


 <div class="td-page-meta ml-2 pb-1 pt-2 mb-0">


 </div>


 <nav id="TableOfContents">
   <ul>
     <li>
       <ul>
         <li><a href="#背景介绍">背景介绍</a></li>
         <li><a href="#环境准备">环境准备</a>
           <ul>
             <li><a href="#nginx日志格式配置">Nginx日志格式配置</a></li>
             <li><a href="#fluent-bit-filter">Fluent bit Filter</a></li>
           </ul>
         </li>
         <li><a href="#oap-日志分析">OAP 日志分析</a>
           <ul>
             <li><a href="#lal定义">LAL定义</a></li>
             <li><a href="#mal定义">MAL定义</a></li>
           </ul>
         </li>
         <li><a href="#参考文档">参考文档</a></li>
       </ul>
     </li>
   </ul>
 </nav>


 <script>
   $(function () {
     var $toc = $("#TableOfContents");
     if (!$toc || !$toc.length) {
       return;
     }
     var top = $toc.offset().top;
     $(window).on("scroll", debounce(setTop, 100))
     $(window).on("scroll", debounce(addActive, 30))

     function addActive() {
       var scrollValue = $(window).scrollTop();
       var topEle = null;
       $.each($('main h1, main h2, main h3'), function (index, item) {
         if ($(item).offset().top - 70 > scrollValue) {
           return
         }
         if (!topEle) {
           topEle = item
         } else if ($(item).offset().top >= $(topEle).offset().top) {
           topEle = item
         }
         if (topEle) {
           var id = $(item).attr('id');
           $toc.find('a').removeClass("active").end().find('a[href="' + '#' + id + '"]').addClass("active")
         }
       })
     }

     function setTop() {
       var scrollValue = $(window).scrollTop();
       if (scrollValue >= top - 70) {
         $toc.addClass('fixed')
       } else {
         $toc.removeClass('fixed')
       }
     }

     function debounce(fn, wait) {
       var timeout = null;
       return function () {
         clearTimeout(timeout);
         timeout = setTimeout(() => {
           fn.apply(this, arguments);
         }, wait);
       };
     }
   })

 </script>


           </div>
         </div>
       </div>

 <footer class="py-5 sky-row">
   <div class="container-fluid text-center">
     <div class="">


 <ul class="list-inline mb-0">

   <li class="list-inline-item mx-2 h3" data-toggle="tooltip" data-placement="top" title="Twitter" aria-label="Twitter">
     <a class="text-color" target="_blank" href="https://twitter.com/asfskywalking">
       <i class="iconfont icon-twitter"></i>
     </a>
   </li>

   <li class="list-inline-item mx-2 h3" data-toggle="tooltip" data-placement="top" title="Slack" aria-label="Slack">
     <a class="text-color" target="_blank" href="http://s.apache.org/slack-invite">
       <i class="iconfont icon-slack"></i>
     </a>
   </li>

   <li class="list-inline-item mx-2 h3" data-toggle="tooltip" data-placement="top" title="Mailing list" aria-label="Mailing list">
     <a class="text-color" target="_blank" href="https://lists.apache.org/list.html?dev@skywalking.apache.org">
       <i class="iconfont icon-email"></i>
     </a>
   </li>

   <li class="list-inline-item mx-2 h3" data-toggle="tooltip" data-placement="top" title="GitHub" aria-label="GitHub">
     <a class="text-color" target="_blank" href="https://github.com/apache/skywalking">
       <i class="iconfont icon-github"></i>
     </a>
   </li>

 </ul>


     </div>
     <div class="">

         <small class="text-color">&copy; 2017 - 2024 The Apache Software Foundation All Rights Reserved</small>


     </div>
     <div class="">
       <small class="text-color mt-4">Apache SkyWalking, SkyWalking, Apache, the Apache feather logo, and the Apache SkyWalking project logo are either registered trademarks or trademarks of the Apache Software Foundation.</small>
     </div>
   </div>
 </footer>


     </div>


 <div class="sky-event-popup">

     <div class="sky-pop-modal">
         <img class="fa-window-close" src="/images/icon-close.svg" alt="">
         <div class="pic-wrapper">
             <img
                     data-img="/images/skywalking_200x200.png"
                     class="pic"
                     alt="event"
             />
         </div>

         <div class="content-box">


             <div class="item"
                  data-img=""
                  data-poster=""
                  data-link="/events/banyandb-on-demo-skywalking/"
                  data-starttime=""
                  data-endtime="2024-06-30T00:00:00Z">
                 <a href="/events/banyandb-on-demo-skywalking/">
                     <h3 class="title">BanyanDB is up and running on SkyWalking demo</h3>
                     <p class="content-text">
                         SkyWalking team announced, BanyanDB has replaced Elasticsearch and is up and running on SkyWalking official demo site.
                     </p>
                 </a>

                 <a href="/events/banyandb-on-demo-skywalking/" class="modal-btn">

                     Read more

                 </a>
             </div>


         </div>
     </div>
 </div>


 <div id="popup">
     <div class="mask">
         <img src=""/>
     </div>
 </div>

     <div class="sidebar-mask"></div>
 <div class="sidebar">
     <nav class="nav-links">
         <div class="nav-item"><a href="/docs/" class="nav-link">Projects and Documentation</a></div>
         <div class="nav-item"><a href="/events/" class="nav-link">Events</a></div>
         <div class="nav-item"><a href="/blog/" class="nav-link router-link-exact-active router-link-active">Blog</a>
         </div>
         <div class="nav-item"><a href="/downloads/" class="nav-link">Downloads</a></div>
         <div class="nav-item"><a href="/team/" class="nav-link">Team</a></div>
         <div class="nav-item"><a href="/users/" class="nav-link">Users</a></div>
         <div class="nav-item">
             <div class="dropdown-wrapper open">
                 <a class="dropdown-title"><span>中文资料</span>
                     <span class="arrow down"></span>
                 </a>
                 <ul class="nav-dropdown">
                     <li class="dropdown-item">
                         <a href="/zh/" class="nav-link external">博客</a>
                     </li>
                     <li class="dropdown-item">
                         <a href="https://space.bilibili.com/390683219" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">B站</a>
                     </li>
                     <li class="dropdown-item">
                         <a href="https://juejin.cn/user/13673577331607" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">掘金</a>
                     </li>
                 </ul>
             </div>
         </div>
         <div class="nav-item">
             <div class="dropdown-wrapper open">
                 <a class="dropdown-title">
                     <span>Links</span>
                     <span class="arrow down"></span>
                 </a>
                 <ul class="nav-dropdown">
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">
                             Apache Software Foundation
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="https://github.com/apache/skywalking/issues"
                            target="_blank" rel="noopener noreferrer"
                            class="nav-link external">
                             GitHub Issue Tracker
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="https://lists.apache.org/list.html?dev@skywalking.apache.org" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">
                             Dev Mailing List
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/licenses/" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">
                             License
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/events/current-event"
                            target="_blank" rel="noopener noreferrer"
                            class="nav-link external">
                             Apache Events
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/security/" target="_blank"
                            rel="noopener noreferrer" class="nav-link external">
                             Security
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/foundation/sponsorship.html"
                            target="_blank" rel="noopener noreferrer"
                            class="nav-link external">
                             Sponsorship and Donate
                         </a>
                     </li>
                     <li class="dropdown-item">
                         <a href="http://www.apache.org/foundation/thanks.html"
                            target="_blank" rel="noopener noreferrer"
                            class="nav-link external">
                             Thanks
                         </a>
                     </li>
                 </ul>
             </div>
         </div>
     </nav>
 </div>

     <script src="/js/bootstrap.bundle.min.js"></script>

 <script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3"></script>


 <script src="/js/main.min.dc00f5ca911ee5aa105ea6de6b3b7e8d8169ba5a3bf156b1fcfe23dfe3e62b0a.js" integrity="sha256-3AD1ypEe5aoQXqbeazt&#43;jYFpulo78Vax/P4j3&#43;PmKwo=" crossorigin="anonymous"></script>


 <script src="/js/mermaid.min.js"></script>
 <script>
     window.onload = () => mermaid.init(undefined, ".language-mermaid");
 </script>


 <script defer
 src="https://widget.kapa.ai/kapa-widget.bundle.js"
 data-website-id="8a08392b-9c4d-4816-8bc4-f93e0ecdd2a7"
 data-project-name="SkyWalking"
 data-project-color="#2B74B8"
 data-button-text="Ask AI"
 data-search-mode-enabled="true"
 data-modal-open-on-command-k="true"
 data-modal-disclaimer="The AI supports multiple languages, but it may not be accessible in China, a proxy is required."
 data-project-logo="https://miro.medium.com/v2/resize:fit:2400/0*kmS-5BQ8ShAhZ_F4.jpg"
 data-modal-example-questions="What is Apache SkyWalking?,How to deploy SkyWalking?,How to inject agents non-intrusively?,How to setup trace sampling?"
 data-button-position-top=""
 data-button-position-right="20px"
 data-button-position-bottom="200px"
 data-button-position-left=""
 ></script>


   </body>
 </html>