out_splitter.rb

class Fluent::SplitterOutput < Fluent::Output                                                                                                                                                                                            
  Fluent::Plugin.register_output('splitter', self)

  PATTERN_MAX_NUM = 20

  (1..PATTERN_MAX_NUM).each do |i|
    config_param ('pattern' + i.to_s).to_sym, :string, :default => nil
  end

  config_param :preserve_tag, :bool, :default => false
  config_param :out_tag_prefix, :string, :default => nil
  config_param :key_names, :string

  def initialize
    super
    require 'time'
  end

  def configure(conf)
    super

    if not @key_names then
      raise Fluent::ConfigError, "missing key_names to parse"
    end

    @patterns = []
    (1..PATTERN_MAX_NUM).each do |i|
      next unless conf["pattern#{i}"]
      name, regexp = conf["pattern#{i}"].split(/\s+/, 2)
      @patterns.push({id: i, name: name, regexp: Regexp.new(regexp)})
    end
  end

  def emit(tag, es, chain)
    tag_prefix = if @preserve_tag && @out_tag_prefix then
                   "#{tag}.#{@out_tag_prefix}"
                 elsif @out_tag_prefix then
                   "#{@out_tag_prefix}"
                 end
    es.each do |time,record|
      match_target = @key_names.split(/\s+/).map {|k|
                       record[k]
                     }.join("	")
      @patterns.each do |pattern|
        if match_target =~ pattern[:regexp] then
          Fluent::Engine.emit("#{tag_prefix}.#{pattern[:name]}", time, record)
        end
      end
    end
    chain.next
  end
end