logstash-7.4 config file for ngnix access.log/ error.log

logstash-nginx-es.conf

input {
  file {
    path => ["/var/log/nginx/access.log", "/var/log/nginx/error.log"]
    type => "nginx"
  }
}

filter {
    if [path] =~ "access.log" {
     
     grok {
      patterns_dir => "/var/log/nginx/patterns"
      match => { "message" => "%{NGINX_ACCESS}" }
      remove_tag => [ "_grokparsefailure" ]
      add_tag => [ "nginx_access" ]
    }

    geoip {
      source => "remote_addr"
    }

    }
    else if [path] =~ "error.log" {

     grok {

    match => {
        "message" => [
            "(?<timestamp>\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) \[%{DATA:err_severity}\] (%{NUMBER:pid:int}#%{NUMBER}: \*%{NUMBER}|\*%{NUMBER}) %{DATA:err_message}(?:, client: (?<client_ip>%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, host: %{QS:client_ip})?(?:, referrer: \"%{URI:referrer})?",

            "%{DATESTAMP:timestamp} \[%{DATA:err_severity}\] %{GREEDYDATA:err_message}"
        ]
    }

  }
  date {
    match => [ "timestamp" , "yyyy/MM/dd HH:mm:ss" ]
    timezone => 'UTC'
  }
  
      
    }
  
}

                                                                                          
output {
 elasticsearch {
   hosts => ["localhost:9200"]
   index => "ngnix"
   document_type => "nginx_logs"
 }
 stdout { codec => rubydebug }
}

nano /var/log/nginx/patterns

NGINX_ACCESS %{IPORHOST:remote_addr} - %{USERNAME:remote_user} \[%{HTTPDATE:time_local}\] \"%{DATA:request}\" %{INT:status} %{NUMBER:bytes_sent} \"%{DATA:http_referer}\" \"%{DATA:http_user_agent}\"