type forward port 24224 type dos_block_acl dryrun true network_acl_id acl-xxxxxxx ip_address_key ip_address dos_threshold 10000 buffer_chunk_limit 256m region ap-northeast-1 deny_rule_numbers_range 1..10 time_slice_format %Y%m%d_%H%M state_file /var/log/td-agent/buffer/dos_block_acl_state.log