Integration

NGINX

Requests and connections, and every access and error log line with status and path.

Category: Web servers
How data is sent: Logthread Agent
Runs on: Linux
Status: Beta

How it works#

Answer a few questions. They only fill in the setup steps. Nothing on this page connects to your servers: Logthread never reaches into your network.
Run one command on the NGINX machine. The next page shows the command with this connector's ingest key filled in. It downloads the Logthread Agent from downloads.logthread.com and installs it as a service (Linux, as root with sudo). No other download.
Data arrives. Everything is collected inside your environment. It is sent over outbound HTTPS (port 443) to ingest.logthread.com. Nothing is opened to the internet: no inbound ports, VPN or public access to your servers. The connection page shows what has arrived and turns Active with the first record.

What you answer#

Question	Answer	Notes
Status page URL (optional)	Text	Default: http://127.0.0.1/nginx_status.
Log folder (optional)	Text	Default: /var/log/nginx.
Labels (optional)	Text	For Fleet and filtering, for example env=prod.
Manage this agent from Fleet	Yes or no	Change its configuration from Logthread later without logging in to the host. Default: `Yes`.

Setup#

These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.

Step 1. Turn on NGINX status. Add this to a server block that listens on the host (stub_status is read-only and shows only counters), then reload NGINX.

nginx.conf:

location = /nginx_status {
    stub_status;
    allow 127.0.0.1;
    deny all;
}
# then: sudo nginx -t && sudo systemctl reload nginx

Step 2. Install the Logthread Agent. On the NGINX host: it installs the agent with the NGINX and Linux host profiles. It reads access.log and error.log from /var/log/nginx and the status page.

curl -sSL https://downloads.logthread.com/agent/install.sh | sudo sh -s -- \
  --key YOUR_INGEST_KEY --profiles linux-host,nginx --fleet

Step 3. Parse the access log. Once lines arrive, attach the NGINX access parser (Then add, below) so status, method and path are fields. It reads the standard "combined" log format.

Check that it works#

The connection page under Integrations counts what has arrived and turns Active with the first record. In Explore, search service:nginx.

Then add#

Each is one click on the connection page and opens with your data, so you can check it before saving.

Dashboard: NGINX: Requests and connections from stub_status, and responses by status from the access log (with the nginx-access parser).
Parser: nginx-access (Pipelines → Library)
Parser: nginx-error (Pipelines → Library)
Alert: NGINX 5xx responses: service:nginx status>=500, at least 20 in 10 minutes
Alert: NGINX errors: service:nginx severity:(error|fatal), at least 10 in 10 minutes

Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.