How to Visualize Nginx Access Logs with Loki and Grafana in Minutes

A client needed website visit statistics without Google or Baidu analytics, so the solution was to collect Nginx access logs and display them via a lightweight stack.

The chosen stack consists of Nginx, Promtail, Loki, and Grafana, which together provide log collection, storage, and visualization.

Promtail is installed as a binary and configured with the following file:

server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://localhost:3100/loki/api/v1/push

scrape_configs:
  - job_name: nginx
    pipeline_stages:
      - replace:
          expression: '(?:[0-9]{1,3}\.){3}([0-9]{1,3})'
          replace: '***'
    static_configs:
      - targets:
          - localhost
        labels:
          job: nginx_access_log
          host: expatsxxxxs
          agent: promtail
          __path__: /var/log/nginx/expatshxxxxs.access.log

After collecting logs, Nginx’s log format is changed to JSON to make it compatible with Loki:

log_format json_analytics escape=json '{'
    "msec": "$msec",
    "connection": "$connection",
    "connection_requests": "$connection_requests",
    "pid": "$pid",
    "request_id": "$request_id",
    "request_length": "$request_length",
    "remote_addr": "$remote_addr",
    "remote_user": "$remote_user",
    "remote_port": "$remote_port",
    "time_local": "$time_local",
    "time_iso8601": "$time_iso8601",
    "request": "$request",
    "request_uri": "$request_uri",
    "args": "$args",
    "status": "$status",
    "body_bytes_sent": "$body_bytes_sent",
    "bytes_sent": "$bytes_sent",
    "http_referer": "$http_referer",
    "http_user_agent": "$http_user_agent",
    "http_x_forwarded_for": "$http_x_forwarded_for",
    "http_host": "$http_host",
    "server_name": "$server_name",
    "request_time": "$request_time",
    "upstream": "$upstream_addr",
    "upstream_connect_time": "$upstream_connect_time",
    "upstream_header_time": "$upstream_header_time",
    "upstream_response_time": "$upstream_response_time",
    "upstream_response_length": "$upstream_response_length",
    "upstream_cache_status": "$upstream_cache_status",
    "ssl_protocol": "$ssl_protocol",
    "ssl_cipher": "$ssl_cipher",
    "scheme": "$scheme",
    "request_method": "$request_method",
    "server_protocol": "$server_protocol",
    "pipe": "$pipe",
    "gzip_ratio": "$gzip_ratio",
    "http_cf_ray": "$http_cf_ray",
    "geoip_country_code": "$geoip_country_code"
}' ;

To enable GeoIP fields, the GeoIP libraries are installed and Nginx is recompiled with the GeoIP module: yum -y install GeoIP GeoIP-data GeoIP-devel Recompile Nginx with --with-http_geoip_module and reload it using kill -USR2 so the new log format takes effect.

Grafana is launched via Docker: docker run -d -p 3000:3000 grafana/grafana After logging in (default admin/admin), a Loki data source is added, and the logs can be explored to confirm they are stored correctly.

A pre‑built dashboard is imported by ID. Because the world‑map panel is required, the plugin is installed:

grafana-cli plugins install grafana-worldmap-panel

After restarting Grafana, the dashboard displays log data on a map; external map tiles may need a reverse proxy to load.

Overall, the Nginx + Promtail + Loki + Grafana stack provides a fast, lightweight way to present detailed website access statistics.