# It is a sample how to exclude specified patterns before analyze response_time for each virtual domain websites.

# appearing plugins:
#  rewrite_tag_filter: http://rubygems.org/gems/fluent-plugin-rewrite-tag-filter
#  forest: http://rubygems.org/gems/fluent-plugin-forest
#  datacounter: http://rubygems.org/gems/fluent-plugin-datacounter
#  growthforecast: http://rubygems.org/gems/fluent-plugin-growthforecast

<source>
  @type tail
  path /var/log/httpd/access_log
  <parse>
    @type regexp
    expression /^(?<domain>[^ ]*) (?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<status>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<response_time>[^ ]*))?$/
    time_format %d/%b/%Y:%H:%M:%S %z
  </parse>
  tag td.apache.access
  pos_file /var/log/td-agent/apache_access.pos
</source>


# Extract specified virtual domain
<match td.apache.access>
  @type rewrite_tag_filter
  <rule>
    key domain
    pattern /^maps\.google\.com$/
    tag filter.GoogleMap
  </rule>
</match>


# Filtering
<match filter.GoogleMap>
  @type rewrite_tag_filter
  <rule>
    key path
    pattern /^\/(img|css|js|static|assets)\//
    tag clear
  </rule>
  <rule>
    key status
    pattern /^(?!200)$/
    tag clear
  </rule>
  <rule>
    key method
    pattern /^(?!GET)$/
    tag clear
  </rule>
  <rule>
    key agent
    pattern /(spider|bot|crawler|\+http\:)/
    tag clean
  </rule>
  <rule>
    key path
    pattern /^\/(admin|api|backend)/
    tag site.GoogleMap.backend
  </rule>
  <rule>
    key path
    pattern /.+/
    tag site.GoogleMap.front
  </rule>
</match>


# Summarize
<match site.**>
  @type datacounter
  unit minute
  count_key response_time
  outcast_unmatched false
  aggregate tag
  tag_prefix gf.responsetime
  output_per_tag yes
  pattern1 0-100msec ^\d{1,5}$
  pattern2 100-300msec ^[1-2]\d{5}$
  pattern3 300-600msec ^[3-5]\d{5}$
  pattern4 600msec-1sec ^[6-9]\d{5}$
  pattern5 1-2sec ^1\d{6}$
  pattern6 2-10sec ^[2-9]\d{6}$
  pattern7 10sec_over ^\d{8,}$
</match>


# Graph
<match gf.responsetime.**>
  @type growthforecast
  remove_prefix gf.responsetime.site
  gfapi_url http://localhost:5125/api/
  tag_for   service
  section   response_time
  name_keys 0-100msec_percentage,100-300msec_percentage,300-600msec_percentage,600msec-1sec_percentage,1-2sec_percentage,2-10sec_percentage,10sec_over_percentage
</match>


# Clear tag
<match clear>
  @type null
</match>

