server.conf

server.conf

<source>
  @id input_forward
  @type forward
  port 24224
</source>

<match club.access>
  @type copy
  <store>
    @type s3

    aws_key_id 
    aws_sec_key 
    s3_bucket 
    s3_region ap-northeast-1

    path logs/${tag}/%Y/%m/%d/
    s3_object_key_format %{path}%{time_slice}_%{index}.%{file_extension}

    <buffer tag,time>
      @type file
      path /var/log/td-agent/s3
      timekey 3600
      timekey_wait 10m
      timekey_use_utc true
      chunk_limit_size 256m
    </buffer>
    <format>
      @type json
    </format>
  </store>
  <store>
    @type elasticsearch
#    host 10.10.103
#    port 9200

    # Logstash形式
    # 日付を含んだインデックス名を利用する
    logstash_format true

    # インデックスの中に作られるtypeの名前を指定する
    type_name access

    # タグをレコードへ任意のキーで追加する
    tag_key @log_name
    include_tag_key true

    flush_interval 10s
  </store>
  <store>
    @type stdout
  </store>
</match>

<match ping.**>
  @type ping_message_checker
  tag alert.ping_message
  check_interval 10
  notification_times 1
  notification yes
</match>
<filter alert.ping_message>
  @type record_transformer
  <record>
    message Fluent node has down (ping was lost): ${record["data"]}
  </record>
</filter>
<match alert.ping_message>
  @type slack
  webhook_url 
  channel general
  username fluent_ping_checker
  color danger
  icon_emoji :ghost:
  buffer_path /var/log/td-agent/buffer/slack.alert.ping_message
  flush_interval 5s
</match>