Skip to main content
Sumo Logic

Collect Logs and Metrics for Nginx Ingress

Learn how to collect log and metrics for the Sumo Logic App for Nginx Ingress.

This page provides instructions for configuring log and metric collection for the Sumo Logic App for Nginx Ingress.

Collection Process Overview

Configuring log and metric collection for the Nginx Ingress App includes the following tasks:

  • Configure Fields in Sumo Logic.
  • Configure Collection for Nginx Ingress.
    • Collect Logs and Metrics for Kubernetes environments.

Configure Fields in Sumo Logic

Create the following Fields in Sumo Logic prior to configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata, which is required by the app dashboards. For information on setting up fields, see the Fields help page.

If you are using Nginx Ingress in a Kubernetes environment create the fields:

  • pod_labels_component
  • pod_labels_environment
  • pod_labels_webserver_system
  • pod_labels_webserver_farm

Configure Collection for Nginx Ingress

Sumo Logic supports the collection of logs and metrics data from Nginx Ingress in Kubernetes environments. 

Please click on the appropriate links below based on the environment where your Nginx Ingress farms are hosted.

  • Collect Logs and Metrics for Kubernetes environments.

Log and Metrics Types

The Sumo Logic App for Nginx Ingress assumes the NCSA extended/combined log file format for Access logs and the default Nginx error log file format for error logs.

All Dashboards (except the Error logs Analysis dashboard) assume the Access log format. The Error logs Analysis Dashboard assumes both Access and Error log formats, so as to correlate information between the two.

For more details on Nginx logs, see http://nginx.org/en/docs/http/ngx_http_log_module.html.

The Sumo Logic App for Nginx Ingress assumes Prometheus format Metrics for Requests, Connections, and Ingress controller.

For more details on Nginx Ingress Metrics, see https://docs.nginx.com/nginx-ingress-controller/logging-and-monitoring/prometheus/

Follow the below instructions to set up the metric collection:

  1. Configure Metrics Collection
    1. Setup Kubernetes Collection with the Telegraf operator.
    2. Add annotations on your Nginx Ingress pods.
  2. Configure Logs Collection
    1. Configure logging in Nginx Ingress.
    2. Add labels on your Nginx Ingress pods to capture logs from standard output.
    3. Collecting Nginx Ingress Logs from a Log file.

Prerequisites

It’s assumed that you are using the latest helm chart version if not please upgrade using the instructions here.

Collect Logs and Metrics for Nginx Ingress

Configuring log and metric collection for the Nginx Ingress App includes the following tasks:

  • Collect Logs and Metrics for Nginx Ingress.

Collect Logs and Metrics for Nginx Ingress

In a Kubernetes environment, we use our Sumo Logic Kubernetes collection. You can learn more about this here.

  1. Before you can configure Sumo Logic to ingest metrics, you must enable the Prometheus metrics in the Nginx Ingress controller and annotate the Nginx Ingress pods, so Prometheus can find the Nginx Ingress metrics.

  1. Ensure you have deployed version 1.3 or higher of the Sumologic-Kubernetes-Collection, to send the logs and metrics to Sumologic. For more information on deploying Sumologic-Kubernetes-Collection, visit here. Once deployed, logs will automatically be picked up and sent by default. Prometheus will scrape the Nginx Ingress pods, based on the annotations set in Step 1, for the metrics. Logs and Metrics will automatically be sent to the respective fluentD stateful sets which consistently tag your logs and metrics, then forward them to your Sumo Logic org.

  2. Apply following labels to the Nginx Ingress pod.

Labels:

environment="prod_CHANGEME"
component="webserver"
  webserver_system="nginx_ingress"
  webserver_farm="<farm_CHANGEME>"

Please enter in values for the following parameters (marked in bold and CHANGE_ME above):

  • environment - This is the deployment environment where the Nginx Ingress farm identified by the value of servers resides. For example:- dev, prod, or QA. While this value is optional we highly recommend setting it.
  • webserver_farm - Enter a name to identify this Nginx Ingress farm. This farm name will be shown in the Sumo Logic dashboards. If you haven’t defined a farm in Nginx Ingress, then enter ‘default’ for webserver_farm.

Here’s an explanation for additional values set by this configuration that we request you please do not modify as they will cause the Sumo Logic apps to not function correctly.

  • component: “webserver” - This value is used by Sumo Logic apps to identify application components. 
  • webserver_system: “nginx_ingress” - This value identifies the database system.
  1. Add an FER to normalize the fields in Kubernetes environments.

Labels created in Kubernetes environments automatically are prefixed with pod_labels. To normalize these for our app to work, we need to create a Field Extraction Rule if not already created for Proxy Application Components. To do so:

  1. Go to Manage Data > Logs > Field Extraction Rules.
  2. Click the + Add button on the top right of the table.
    The following form appears:

clipboard_ee03d9be7a2d49dc00b43c34f135cecc0.png

Enter the following options:

  1. Rule Name. Enter the name as App Observability - Webserver.
  2. Applied At. Choose Ingest Time.
  3. Scope. Select Specific Data.
  4. Scope: Enter the following keyword search expression. 
pod_labels_environment=* pod_labels_component=webserver pod_labels_webserver_farm=* pod_labels_webserver_system=*

o Parse Expression. Enter the following parse expression.

if (!isEmpty(pod_labels_environment), pod_labels_environment, "") as environment
| pod_labels_component as component
| pod_labels_webserver_system as webserver_system
| pod_labels_webserver_farm as webserver_farm