Who will advise the web server log analyzer?

Question

Nginx

Good day, dear All.
Perhaps someone can recommend a web server log analyzer that would be able to accumulate statistics and respond to anomalies. I have come across similar products from the IDS/IPS category, but I haven't seen them specifically for web servers.
Ideally, you want a robot that would initially chew logs, say, for a month, draw conclusions - for example, how many requests per second go to servers on average, their distribution by client IP addresses, by requested URLs, by user agents, and more something - and then, watching the logs in real time, reacted to anomalies - they say, dude, and here they are trying to download your entire site from the IP address 1.2.3.4, but there a tricky DDoS attack of level 7 began.
So far, I managed with various self-written analyzers, the data of which I fed to Zabbix, but the realities of life (the server periodically gives sharp bursts of load, while it is completely unclear what it is connected with) make us think about something more serious.

Answer 1

ru.splunk.com
Suitable not only for web server logs, there is a free option

Answer 2

Well, syslog-ng, what could be cooler. https://syslog-ng.org/

Answer 3

Statistical analysis:
awstats
webalizer
(but why are they needed now when there is Google Analytics?)
www.valencynetworks.com/articles/top-10-web-log-an...
Security analysis:
apache-scalp
IDA (Intrusion Detection for Apache )
Generally looking what server. they are different and analyzers are different. The situation becomes more complicated if you set a reverse proxy or the web server sends interpreted code to the backend (AJP, [Fast / S] CGI). In short, describe the situation in more detail.

Answer 4

ELK Stack (Elasticsearch, Logstash, Kibana)
elastic.co
ELK Stack for Network Operations [RELOADED]
www.networkassassin.com/elk-stack-for-network-oper...