Lab: Parse nginx logs with Vector and VRL with correction

What you will learn in this TP

• Write a VRL transformation
• Route to Loki
• Produce metrics

Introduction #

What you will learn in this section

• Write a VRL transformation
• Route to Loki
• Produce metrics

Context. The website exposes no HTTP metrics, but nginx writes access logs. You get both structured logs and metrics out of them.

Prerequisites: Docker Compose  ·  Estimated time: 45 min

Structured logs and metrics from a simple file.

Setup #

Guided steps, with their solutions.

1. 1. Prepare nginx and the traffic

   Why? nginx writes its logs to a volume shared with Vector.

   Create a Compose file with nginx (logs in a volume), a request generator (including 404s) and Loki.
   See the correction

   services:
     nginx:
       image: nginx:alpine
       command: [sh, -c, "rm -f /var/log/nginx/access.log && nginx -g 'daemon off;'"]
       volumes: ["nginxlogs:/var/log/nginx"]
     trafic:
       image: curlimages/curl
       entrypoint: [sh, -c, "while true; do curl -s nginx/ >/dev/null; curl -s nginx/absent >/dev/null; sleep 0.5; done"]
     loki:
       image: grafana/loki:latest
       command: [-config.file=/etc/loki/local-config.yaml]
       ports: ["3100:3100"]
   volumes: { nginxlogs: {} }

2. 2. Write the transformation

   Why? VRL extracts the fields and converts the types: you can then filter and aggregate.

   Create vector.yaml with a file source and a remap that parses the combined format.
   See the correction

   api: { enabled: true, address: 0.0.0.0:8686 }
   sources:
     nginx:
       type: file
       include: [/var/log/nginx/access.log]
   transforms:
     parse:
       type: remap
       inputs: [nginx]
       source: |
         p = parse_regex!(.message, r'^(?P<ip>\S+) \S+ \S+ \[(?P<ts>[^\]]+)\] "(?P<method>\S+) (?P<path>\S+) \S+" (?P<status>\d+) (?P<bytes>\d+)')
         . = merge(., p)
         .status = to_int!(.status)
         .bytes = to_int!(.bytes)
         del(.ts)
   sinks:
     loki:
       type: loki
       inputs: [parse]
       endpoint: http://loki:3100
       encoding: { codec: json }
       labels: { job: vector, method: "{{ method }}" }

3. 3. Run and observe

   Why? vector tap shows the transformed events live.

   Add Vector to the Compose file, start it and inspect the output of parse.
   See the correction

     vector:
       image: timberio/vector:latest-alpine
       volumes: ["./vector.yaml:/etc/vector/vector.yaml", "nginxlogs:/var/log/nginx:ro"]
       ports: ["8686:8686", "9598:9598"]

   docker compose up -d
   docker compose exec vector vector tap parse --limit 3

4. 4. Derive metrics

   Why? To count requests by status without touching nginx.

   Add a log_to_metric and a prometheus_exporter sink on port 9598, then read the metrics.
   See the correction

   transforms:
     metriques:
       type: log_to_metric
       inputs: [parse]
       metrics:
         - type: counter
           field: status
           name: nginx_requests_total
           tags: { status: "{{ status }}" }
   sinks:
     prom:
       type: prometheus_exporter
       inputs: [metriques]
       address: 0.0.0.0:9598

   docker compose restart vector && sleep 10 && curl -s localhost:9598/metrics | grep nginx_requests_total

5. 5. Check in Loki

   Why? The extracted fields can be filtered directly in LogQL.

   Display the 404 requests.
   See the correction

   curl -sG localhost:3100/loki/api/v1/query_range --data-urlencode 'query={job="vector"} | json | status = 404' --data-urlencode limit=3 | jq -r '.data.result[].values[][1]'

Difficulty level : ●●●○○ (3/5)