Sharing for community benefit.
If you are using the Elastic Filebeat nginx module with ingress-nginx or currently using ingress-nginx and you want to match the logging format from ingress-nginx in NGF, this post is for you.
The existing log format for ingress-nginx is:
$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id
In NGF, 3 of these ingress-nginx variables don’t exist, so they need new variables:
old: [$proxy_upstream_name]
new: [$proxy_host]
old: [$proxy_alternative_upstream_name]
new: [-]
old: $req_id
new: $request_id
To modify NGF to change to the ingress-nginx log format
nginx:
logging:
accessLog:
format: >-
$remote_addr - $remote_user [$time_local] "$request" $status
$body_bytes_sent "$http_referer" "$http_user_agent" $request_length
$request_time [$proxy_host] [-] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $request_id
Note: the format of the field nginx.ingress_controller.upstream.name changes:
ingress-nginx: <namespace>-<app-name>-<ingress port name>
NGF: <namespace>_<app-name>_<httproute port number>
Hoping this helps someone else as they migrate for ingress-nginx to NGF with Elastic logging.
Cheers!