td-agent_sender_to_slack.conf

# Input Nginx AccessLog.
<source>
  type tail
  tag  nginx.error
  path /var/log/nginx/error.log
  pos_file /var/log/td-agent/flag_error.pos
  format /^(?<time>.+) \[(?<level>[^\]]+)\] *(?<message>.*)$/
  time_format %Y/%m/%d %H:%M:%S
</source>

<match nginx.error>
  type rewrite_tag_filter
  rewriterule1 level error  slack.error.${tag}
  rewriterule2 level warn   slack.warn.${tag}
  rewriterule3 level fatal  slack.fatal.${tag}
</match>

<match slack.**>
  type record_reformer
  tag reformed.${tag}
  <record>
    source_id ${tag_suffix[1]}
  </record>
</match>

# エラーレベルによって通知先を変更できる例として以下分けて書いてます。
<match reformed.slack.error**>
  type slack
  webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
  channel hogehoge
  username fluentd
  title_keys source_id
  title %s
  color danger
  flush_interval 5s
</match>

<match reformed.slack.warn**>
  type slack
  webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
  channel hogehoge
  username fluentd
  title_keys source_id
  title %s
  color danger
  flush_interval 5s
</match>

<match reformed.slack.fatal**>
  type slack
  webhook_url https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx
  channel hogehoge
  username fluentd
  title_keys source_id
  title %s
  color danger
  flush_interval 5s
</match>