Отправка логов NGINX в GrayLog

# cat /etc/nginx/graylog.conf
log_format  graylog2_format  '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for" ';

# replace the hostnames with the IP or hostname of your Graylog2 server
access_log syslog:server=server.kiev.ua:514 graylog2_format;
error_log syslog:server=server.kiev.ua:514;

В конфиге nginx в секции http { } указываем

### Send to graylog ###
include /etc/nginx/graylog.conf;
### End send to graylog ###

Если нужен вывод в json, то так

# cat /etc/nginx/graylog.conf
log_format graylog_json '{ "timestamp": "$time_iso8601", "remote_addr": "$remote_addr", "body_bytes_sent": $body_bytes_sent, "request_time": $request_time, "response_status": $status, "request": "$request", "request_method    ": "$request_method", "host": "$host", "upstream_cache_status": "$upstream_cache_status", "upstream_addr": "$upstream_addr", "http_x_forwarded_for": "$http_x_forwarded_for", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent", "http_version": "$server_protocol", "nginx_access": true }';


access_log syslog:server=server.kiev.ua:514 graylog_json;
error_log  syslog:server=server.kiev.ua:514,facility=local0,tag=nginx,severity=error warn;