apacheのアクセスログ（LTSV）のステータスコードをカウントしてzabbixに送るtd-agent.conf

td-agent.conf

<source>
  type forward
  port 24224
</source>

<match {web*,stg*}.**.apache.access>
  type copy
  <store>
    type forest
    subtype file_alternative
    <template>
      path /var/log/td-agent/file/__TAG__.log
      time_slice_format %Y%m%d-%H
      output_include_time false
      output_include_tag false
      output_data_type attr:message
      add_newline true
    </template>
  </store>
  <store>
    type parser
    key_name message
    add_prefix parsed
    #format /^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$/
    #time_format %d/%b/%Y:%H:%M:%S %z
    format apache
  </store>
</match>

<match {web*,stg*}.**.apache.access.ssl>
  type copy
  <store>
    type forest
    subtype file_alternative
    <template>
      path /var/log/td-agent/file/__TAG__.log
      time_slice_format %Y%m%d-%H
      output_include_time false
      output_include_tag false
      output_data_type attr:message
      add_newline true
    </template>
  </store>
  <store>
    type parser
    key_name message
    add_prefix parsed
    format /^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] (?<ssl>[^ ]*) (?<cipher>[^ ]*) "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$/
    time_format %d/%b/%Y:%H:%M:%S %z
  </store>
</match>

<match parsed.**.stg-hoge.**>
  type rewrite_tag_filter
  rewriterule1 code .* rewrite.stg-hoge
</match>

<match rewrite.**>
  type copy
  <store>
    type forest
    subtype datacounter
    <template>
      count_key code
      aggregate all
      tag stats.code.__TAG__
      pattern1 2xx ^2\d\d$
      pattern2 3xx ^3\d\d$
      pattern3 4xx ^4\d\d$
      pattern4 5xx ^5\d\d$
    </template>
  </store>
</match>

<match stats.code.**>
  type copy
  <store>
    type forest
    subtype file_alternative
    <template>
      path /var/log/td-agent/file/zabbix-__TAG__.log
      time_slice_format %Y%m%d-%H
      output_include_time false
      output_include_tag false
      #output_data_type attr:message
      add_newline true
    </template>
  </store>
  <store>
    type forest
    subtype zabbix
    <template>
      zabbix_server localhost
      host web-status
      name_key_pattern [2345]xx_count
      add_key_prefix __TAG__
    </template>
  </store>
  <store>
    type forest
    subtype zabbix
    <template>
      zabbix_server localhost
      host web-status
      name_key_pattern [2345]xx_percentage
      add_key_prefix __TAG__
    </template>
  </store>
</match>