2

I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog.

To get nginx working I've had to install the nginx content pack from Graylog Marketplace.

I had to add the following to nginx.conf:

log_format  graylog2_format  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" <msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';

access_log syslog:server={redacted}:12301 graylog2_format;
error_log syslog:server={redacted}:12302;

I followed the instructions and everything works like it should. I receive all logs from nginx.

What I want to do now is also send along the header X-API-KEY, that nginx receives, to Graylog.

I've tried adding "$http_x_api_key" to log_format in nginx.conf, like so:

log_format  graylog2_format  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_x_api_key" "$http_referer" "$http_user_agent" "$http_x_forwarded_for" <msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';

But this results in none of the nginx logs to be sent to Graylog.

What else can I try?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.