Log custom header X-API-KEY from nginx to Graylog


#1

I have an nginx (1.12.1) server running on VPS#1 and I have Graylog running on VPS#2. All sys + nginx logs are sent to Graylog.

To get nginx logging in Graylog working I’ve had to install the nginx content pack from Graylog Marketplace.

I had to add the following to nginx.conf:

log_format  graylog2_format  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" <msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';

access_log syslog:server={redacted}:12301 graylog2_format;
error_log syslog:server={redacted}:12302;

I followed the instructions and everything works like it should. I receive all logs from nginx.

What I want to do now is also send along the header X-API-KEY, that nginx receives, to Graylog.

I’ve tried adding "$http_x_api_key" to log_format in nginx.conf, like so:

log_format  graylog2_format  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_x_api_key" "$http_referer" "$http_user_agent" "$http_x_forwarded_for" <msec=$msec|connection=$connection|connection_requests=$connection_requests|millis=$request_time>';

But this results in none of the nginx logs to be sent to Graylog.

What else can I try?


(system) #2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.