Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
# Input Nginx AccessLog.
<source>
type tail
tag nginx.error
path /var/log/nginx/error.log
pos_file /var/log/td-agent/flag_error.pos
format /^(?<time>.+) \[(?<level>[^\]]+)\] *(?<message>.*)$/
time_format %Y/%m/%d %H:%M:%S
</source>
<match nginx.error>
type rewrite_tag_filter
rewriterule1 level error slack.error.${tag}
rewriterule2 level warn slack.warn.${tag}
rewriterule3 level fatal slack.fatal.${tag}
</match>
<match slack.**>
type record_reformer
tag reformed.${tag}
<record>
source_id ${tag_suffix[1]}
</record>
</match>
# エラーレベルによって通知先を変更できる例として以下分けて書いてます。
<match reformed.slack.error**>
type slack
webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
channel hogehoge
username fluentd
title_keys source_id
title %s
color danger
flush_interval 5s
</match>
<match reformed.slack.warn**>
type slack
webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
channel hogehoge
username fluentd
title_keys source_id
title %s
color danger
flush_interval 5s
</match>
<match reformed.slack.fatal**>
type slack
webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
channel hogehoge
username fluentd
title_keys source_id
title %s
color danger
flush_interval 5s
</match>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.