td-agent.slack.conf

##
# fluent log Slack Notification
<match fluent.**>
  type record_modifier
  tag internal.message.${hostname}

  host ${hostname}
  include_tag_key
  tag_key original_tag
</match>

<match internal.message.*>
  type       filter
  all        allow
  deny       message: /^xxxx/, message: /^yyyy/
</match>

<match filtered.internal.message.*>
  type              suppress
  interval          10
  num               2
  attr_keys         host,message
  remove_tag_prefix filtered.
  add_tag_prefix    fluentd.
</match>

<match fluentd.internal.message.*>
  type buffered_slack
  api_key xxxx
  team mtburn
  channel %23fluentd-notify
  username app-notifier
  color warn
  icon_emoji :ghost:
  timezone Asia/Tokyo
  buffer_path /mtburn/tmp/td-agent/fluentd-log-slack-buffer
  flush_interval 5s
</match>