title: How to send nginx logs to ELK in JSON format?
body: <p>There is a log form nginx:</p>
  
  <pre><code>log_format apatsev escape=json
    '{'
      '"body_bytes_sent":"$body_bytes_sent",'
      '"bytes_sent":"$bytes_sent",'
      '"request_length":"$request_length",'
      '"server_port":"$server_port",'
      '"status":"$status",'
    '}';
  </code></pre>
  
  <p>Nginx config:</p>
  
  <pre><code>server {
      listen 80;
      server_name service-dev.mycompany.io;
      access_log syslog:server=10.233.60.114:5140 apatsev;
  </code></pre>
  
  <p>With ngrep (tcpdump) see:</p>
  
  <pre><code>U 10.2.53.165:38051 -&gt; 10.233.60.114:5140 #18
    &lt;190&gt;Mar 19 10:40:07 dev-int-load-balancer2 nginx: {"body_bytes_sent":"81","bytes_sent":"257","request_length":"520","server_port":"80","status":"200",}
  </code></pre>
  
  <p>logstash.conf:</p>
  
  <pre><code>input {
    syslog {
          host =&gt; "0.0.0.0"
          port =&gt; 5140
          type =&gt; "log"
          }
    }
  
  filter {
  grok {
     match =&gt; [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
     overwrite =&gt; [ "message" ]
  }
  geoip {
     source =&gt; "clientip"
  }
  
  mutate {
     convert =&gt; ["response", "integer"]
     convert =&gt; ["bytes", "integer"]
     convert =&gt; ["responsetime", "float"]
  }
  
  date {
     match =&gt; [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
  }
  
  useragent {
     source =&gt; "agent"
      }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["127.0.0.1:9200"]
      index =&gt; "apatsev-nginx-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>
  
  <p>If send is not JSON, ELK responsive field.</p>
  
  <p>If you send JSON, all JSON is inside the message field.</p>
  
  <p>At least how to delete a row </p>
  
  <pre><code>&lt;&lt; &lt; 190 &gt; Mar 19 10: 40: 07 dev-int-load-balancer 2 nginx:
  </code></pre>
  
  <p>before JSON ?</p>