increment graphite metrics via statsd from matched syslog lines using syslog-ng

syslog-ng.statsd.conf

# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:expandtab

# assumes RFC5424 format and a SD-ELEMENT "x-service" in the SD-ID "origin"

# customize to taste
@define statdprefix "service.${.SDATA.origin.x-service}."

# send your log data to port 8888
source s_logdata {
    udp(port(8888) flags(syslog-protocol) tags("logdata"));
};

# update to where your statsd server lives
destination d_statsd {
    udp("127.0.0.1" port(8125) template("`statdprefix`${.SDATA.stat.name}:1|c"));
};

block channel increment( match() metric() ) {
    filter { message("`match`"); };
    rewrite { set("`metric`" value(".SDATA.stat.name")); };
    destination(d_statsd);
};

log {
    source(s_logdata);
    junction {
        channel { increment(match("closed MySQL connection") metric("mysql.disconnect")); };
        channel { increment(match("Exception ActiveRecord::StatementInvalid") metric("exception.statementinvalid")); };
        # insert more matches here
    };
};