To get Nginx to log in JSON format you have to add the following to “nginx.conf” under the http bit:
log_format json '{ "@timestamp": "$time_iso8601", '
'"message": "$remote_addr - $remote_user [$time_local] \\\"$request\\\" $status $body_bytes_sent \\\"$http_referer\\\" \\\"$http_user_agent\\\"", '
'"tags": ["nginx_access"], '
'"realip": ""$remote_addr", '
'"proxyip": "$http_x_forwarded_for", '
'"remote_user": "$remote_user", '
'"contenttype": "$sent_http_content_type", '
'"bytes": $body_bytes_sent, '
'"duration": "$request_time", '
'"status": "$status", '
'"request": "$request", '
'"method": "$request_method", '
'"referrer": "$http_referer", '
'"useragent": "$http_user_agent" }';
and then in your vhost configuration you add the following line:
access_log /var/log/nginx/access.json json;