使用上面的logstash配置文件，需要注意更改nginx日志格式，nginx日志格式应该改为如下：
log_format elk "$http_x_forwarded_for | $time_local | $request | $status | $body_bytes_sent | "
"$request_body | $content_length | $http_referer | $http_user_agent | "
"$http_cookie | $remote_addr | $hostname | $upstream_addr | $upstream_response_time | $request_time|$gzip_ratio";
access_log /data/log/nginx/access.log elk;
error_log /data/log/nginx/error.log;