How to Collect Nginx Access & Error Logs with Filebeat, Logstash, and Rsyslog

Because Nginx is widely used as a high‑performance HTTP and reverse‑proxy server, its access and error logs are valuable for user behavior analysis and security monitoring.

1. Directly collect logs with Filebeat to Elasticsearch

Configure filebeat.yml to specify the log file paths and the Elasticsearch output.

- type: log
# Change to true to enable this input configuration.
  enabled: true
# Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    - /usr/local/nginx/logs/*.log
    # - c:\programdata\elasticsearch\logs\*

Start Filebeat: ./filebeat -e -c filebeat.yml -d "publish" After Filebeat runs, the Nginx access.log and error.log appear in Elasticsearch and can be visualized in Kibana or with the Elasticsearch‑head plugin.

2. Collect logs via Filebeat → Logstash → Elasticsearch

Create a Logstash pipeline file filebeat-pipeline.conf that receives beats on port 5044 and forwards them to Elasticsearch.

input {
    beats {
        port => "5044"
    }
}
output {
    elasticsearch { hosts => ["172.28.65.24:9200"] }
    stdout { codec => rubydebug }
}

Start Logstash with automatic config reload:

bin/logstash -f filebeat-pipeline.conf --config.reload.automatic

Modify filebeat.yml to output to Logstash instead of Elasticsearch:

#output.elasticsearch:
#  hosts: ["172.28.65.24:9200"]
output.logstash:
  hosts: ["172.28.65.24:5044"]

Run Filebeat again; logs flow through Logstash and appear in Elasticsearch, visible in Kibana and Elasticsearch‑head.

3. Collect logs via rsyslog → Logstash → Elasticsearch

When the target web server cannot install Filebeat, forward Nginx logs using syslog. Add syslog output in nginx.conf:

access_log syslog:server=172.28.65.32:514,facility=local7,tag=nginx_access_log,severity=info;
error_log syslog:server=172.28.65.32:514,facility=local7,tag=nginx_error_log,severity=info;

Create a Logstash pipeline syslog-pipeline.conf to receive syslog on port 514 and store it in Elasticsearch.

input {
    syslog {
        type => "system-syslog"
        port => 514
    }
}
output {
    elasticsearch {
        hosts => ["172.28.65.24:9200"]
        index => "system-syslog-%{+YYYY.MM}"
    }
    stdout { codec => rubydebug }
}

Start Logstash:

bin/logstash -f syslog-pipeline.conf --config.reload.automatic

If Nginx cannot emit syslog directly, configure rsyslog on the Nginx host to monitor the log files and forward them:

$ModLoad imfile
$InputFilePollInterval 1
$WorkDirectory /var/spool/rsyslog
$PrivDropToGroup adm

# Nginx access log
$InputFileName /usr/local/nginx/logs/access.log
$InputFileTag nginx-access:
$InputFileStateFile stat-nginx-access
$InputFileSeverity info
$InputFilePersistStateInterval 25000
$InputRunFileMonitor

# Nginx error log
$InputFileName /usr/local/nginx/logs/error.log
$InputFileTag nginx-error:
$InputFileStateFile stat-nginx-error
$InputFileSeverity error
$InputFilePersistStateInterval 25000
$InputRunFileMonitor

*.* @172.28.65:514

Restart rsyslog: systemctl restart rsyslog After sending requests to the Nginx service (e.g., http://172.28.65.32/), the logs appear in Logstash’s console and are indexed in Elasticsearch, where they can be inspected with Kibana or Elasticsearch‑head.

The article summarizes several practical ways to collect Nginx access and error logs using Filebeat, Logstash, and rsyslog, allowing you to choose the most suitable method for your environment.