td-agent.conf

<source>
  type tail
  format apache2
  path /var/log/apache2/access.log #This is the location of your Apache log
  tag apache.access
</source>

<match apache.access>
  type grepcounter
  count_interval 60 #Time window to grep and count the # of events
  input_key code #We look at the (http status) "code" field
  regexp ^5\d\d$ #This regexp matches 5xx status codes
  threshold 100 #The # of events to trigger emitting an output
  add_tag_prefix error_5xx #The output event's tag will be error_5xx.apache.access
</match>

<match error_5xx.apache.access>
  # The event that comes here looks like
  #{
  #  "count":1,
  #  "input_tag":"error_5xx.apache.access",
  #  "input_tag_last":"access",
  #  "message":[500]
  #}

  # For testing
  <store>
    type stdout
  </store>

  <store>
    type mail
    host smtp.gmail.com #This is for Gmail and Google Apps. Any SMTP server should work
    port 587 #This is the port for smtp.gmail.com
    user <user_mail_address>
    password <user_password>
    enable_starttls_auto true
    from YOUR_SENDER_EMAIL_HERE
    to YOUR_RECIPIENT_EMAIL_HERE
    subject '[URGENT] APACHE 5XX ERROR'
    message Total 5xx error count: %s\n\nPlease check your Apache webserver ASAP
    message_out_keys count #The value of 'count' will be substituted into %s above.
  </store>
</match>