# Send nginx log in json format **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 18, 2018, 12:23pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082 "2018-12-18T12:23:58Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 12:23pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/1 "2018-12-18T12:23:59Z")
Hello, i have 2 question. 1st is: how i can send nginx log in graylog in json format? what setting in nginx.conf i need? my settings now is : `log_format graylog_json escape=json '{' '"timestamp":"$time_local",' '"level":"1",' '"city":"testing",' '"http_user_agent":"$http_user_agent",' '}';` But is doesn’t work. And 2nd question : how i can use json exctractor for add new fields? I want make this without pipeline. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 18, 2018, 12:26pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/2 "2018-12-18T12:26:43Z")
> [@Uporaba](#): > > But is doesn’t work. What exactly doesn’t work? Right now you’re telling the mechanic “_My car broke_”, without stating: - What are the symptoms? - Which of the parts is showing errors, if any? - What are the errors? - What is the expected behaviour that you were checking for? - What is the behaviour that you actually got? Etc. > [@Uporaba](#): > > how i can use json exctractor for add new fields? I want make this without pipeline. I do believe the documentation site for Graylog may have some details for you on that… I suggest Googling a bit first; I’d have to do the same 🙂 To my knowledge: “extractors” is the keyword 🙂 ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 12:31pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/3 "2018-12-18T12:31:54Z")
> [@Totally\_Not\_A\_Robot](#): > > how i can use json exctractor for add new fields? I want make this without pipeline. Documentation site have have not enough information. I used google for find answer in my question and when i understanded what i can’t solve problem i going on forum. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 18, 2018, 12:32pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/4 "2018-12-18T12:32:52Z")
Cool! In that case, which documentation have you found (please link the sources), what have you tried so far and yet again: what is happening, what is going wrong, what is not behaving as expected, etc. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 12:35pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/5 "2018-12-18T12:35:46Z")
Okay,wait a sec. I makes screenshot. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:05pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/6 "2018-12-18T13:05:25Z")
> [@Totally\_Not\_A\_Robot](#): > > What exactly doesn’t work? Right now you’re telling the mechanic “ _My car broke_ ”, without stating: Okay lets start. My nginx.conf have format: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/74c04dbd4fa550e3def70a81042adf4106d1bf06.png) How says google in this format nginx can send logs in json format. This what graylog showed: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/62b146c240fc11a2f13d92e5da71d1104ee69154.png) Then go for the create json extractors: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d15b95b39c67fbcd83202b124e5165606040158f.png) And set params for extracting: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f0787611e32cc4281fb8bc22b71fc79ab6cd4b32.png) Press on “Try” button and that’s what i got: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4310b947c0bb01135709a2b3355fe82b1b96daae.png) Finally what i want?: I want what extractor parsed log and made and add new key-value fields ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 18, 2018, 1:11pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/7 "2018-12-18T13:11:01Z")
I assume that you’ve seen this ServerFault thread? > Looks very much like your situation. I see one difference though: the log format they use is “graylog2\_json”. Note the extra “2”. The good thing is that your screenshots show that Graylog is in fact receiving the raw messages. That’s good! ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:11pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/8 "2018-12-18T13:11:56Z")
Okay, i will look this. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 18, 2018, 1:12pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/9 "2018-12-18T13:12:37Z")
Also your key-value seperator is incorrect. - You defined it as = - The raw message shows it’s : The ServerFault thread also mentions a content pack you can use to make life easier. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:19pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/10 "2018-12-18T13:19:49Z")
I chang And is didn’t help ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4c599086d2d1bb717a81e9713088913a6123094b.png) ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:20pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/11 "2018-12-18T13:20:18Z")
and add “2” in nginx.conf ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:24pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/12 "2018-12-18T13:24:53Z")
> In this issue he say what cant get nginx log. But i can. ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 18, 2018, 1:28pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/13 "2018-12-18T13:28:18Z")
Well, I didn’t mean they have the same problem. I meant that you could sneak a peek at their settings, see where things are different. I see they also offered a sample extractor and that they referred to a specific _content pack_ which you may not have installed. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [December 18, 2018, 1:38pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/14 "2018-12-18T13:38:46Z")
@Uporaba what was the reason you want to feed in json from NXLOG to Graylog and not using any known - well working extractor? ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:40pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/15 "2018-12-18T13:40:09Z")
remember please,a dont understand. ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:44pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/16 "2018-12-18T13:44:22Z")
I read it again and understood. sry ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 1:48pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/17 "2018-12-18T13:48:06Z")
> [@jan](#): > > what was the reason you want to feed in json from NXLOG to Graylog and not using any known - well working extractor? I dont know. Do you have a solution my problem? ---
**Author:** ![Uporaba](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/uporaba/32/11232_2.png) [@Uporaba](https://community.graylog.org/u/Uporaba)\ **Post date:** [December 18, 2018, 2:04pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/18 "2018-12-18T14:04:10Z")
I don’t want use _content pack_. I want use clean json nginx log without other modification. Because json format allows you to automatically add new fields in the graylog without additional settings from the gray log and without administrator intervention. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 1, 2019, 2:04pm UTC](https://community.graylog.org/t/send-nginx-log-in-json-format/8082/19 "2019-01-01T14:04:16Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.