# It is a sample how to exclude specified patterns before analyze response_time for each virtual domain websites.

# appearing plugins:
#  rewrite_tag_filter: http://rubygems.org/gems/fluent-plugin-rewrite-tag-filter
#  forest: http://rubygems.org/gems/fluent-plugin-forest
#  datacounter: http://rubygems.org/gems/fluent-plugin-datacounter
#  growthforecast: http://rubygems.org/gems/fluent-plugin-growthforecast

<source>
  type tail
  path /var/log/httpd/access_log
  format /^(?<domain>[^ ]*) (?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<status>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<response_time>[^ ]*))?$/
  time_format %d/%b/%Y:%H:%M:%S %z
  tag td.apache.access
  pos_file /var/log/td-agent/apache_access.pos
</source>


# Extract specified virtual domain
<match td.apache.access>
  type rewrite_tag_filter
  rewriterule1 domain ^maps\.google\.com$ filter.GoogleMap
</match>


# Filtering
<match filter.GoogleMap>
  type rewrite_tag_filter
  rewriterule1 path ^/(img|css|js|static|assets)/ clear
  rewriterule2 status ^(?!200)$ clear
  rewriterule3 method ^(?!GET)$ clear
  rewriterule4 agent (spider|bot|crawler|\+http\:) clear
  rewriterule5 path ^/(admin|api|backend) site.GoogleMap.backend
  rewriterule6 path .+ site.GoogleMap.front
</match>


# Summarize
<match site.**>
  type forest
  subtype datacounter
  <template>
    unit minute
    count_key response_time
    outcast_unmatched false
    aggregate all
    tag gf.responsetime.__TAG__
    pattern1 0-100msec ^\d{1,5}$
    pattern2 100-300msec ^[1-2]\d{5}$
    pattern3 300-600msec ^[3-5]\d{5}$
    pattern4 600msec-1sec ^[6-9]\d{5}$
    pattern5 1-2sec ^1\d{6}$
    pattern6 2-10sec ^[2-9]\d{6}$
    pattern7 10sec_over ^\d{8,}$
  </template>
</match>


# Graph
<match gf.responsetime.**>
  type forest
  subtype growthforecast
  remove_prefix gf.responsetime.site
  <template>
    gfapi_url http://localhost:5125/api/
    service   __TAG__
    section   response_time
    name_keys 0-100msec_percentage,100-300msec_percentage,300-600msec_percentage,600msec-1sec_percentage,1-2sec_percentage,2-10sec_percentage,10sec_over_percentage
  </template>
</match>


# Clear tag
<match clear>
  type null
</match>