nginx Nginx Configurations Logging to Syslog, incl. mapping of HTTP-Codes to Syslog severities.

Example

Paste this snippet somewhere in the http {} Block; or place it in it's own file in the /etc/nginx/conf.d/ folder. Also see the official docs for logging to syslog.

# 
# Access Log
# 
log_format fmt_syslog '[$time_local] $status $remote_addr $http_host "$request" $body_bytes_sent $request_time "$http_user_agent" $remote_user';
map $status $log_is_error { "~^5\d\d"     1; default 0; }
map $status $log_is_warn  { "~^4[0-8]{2}" 1; default 0; }
map $status $log_is_info  { "~^[1-3]\d\d" 1; default 0; }
access_log syslog:server=unix:/run/systemd/journal/syslog,nohostname,facility=local2,severity=error fmt_syslog if=$log_is_error;
access_log syslog:server=unix:/run/systemd/journal/syslog,nohostname,facility=local2,severity=warn  fmt_syslog if=$log_is_warn;
access_log syslog:server=unix:/run/systemd/journal/syslog,nohostname,facility=local2,severity=info  fmt_syslog if=$log_is_info;
#
# Error Log
#
error_log syslog:server=unix:/run/systemd/journal/syslog,nohostname,facility=local2 error;

This example assumes rsyslog (or similar) is listening on Socket /run/systemd/journal/syslog - as it's default on Debian 8 when journald has activated ForwardToSyslog. Using this socket, you bypass journald. If that socket is not available try /dev/log instead.

Feel free to use another facility instead of local2. You may also change the log_format to suit your needs.