# Tail docker logs
<source>
  @type tail
  read_from_head true
  path /fluentd/containers/*/*-json.log
  pos_file /fluentd/log/docker.pos
  time_format %Y-%m-%dT%H:%M:%S
  tag docker.*
  format json
</source>

# Add container id
<filter docker.fluentd.containers.*.*.log>
  @type record_transformer
  <record>
    container_id ${tag_parts[3]}
  </record>
</filter>

# Errors only
<filter docker.**>
  @type grep
  <regexp>
    key log
    pattern /\[error\]|\| error \|/i
  </regexp>
</filter>

<match docker.**>
  @type copy

  # Write errors to file
  <store>
    @type file
    path /fluentd/log/docker-error
  </store>

  # Tag daily errors
  <store>
    @type grepcounter
    count_interval 14400 # = 4 hours
    input_key log
    threshold 1
    add_tag_prefix daily_error
  </store>
</match>

# Send daily error mail
#<match daily_error.docker.**>
#  @type mail
#  host [Host]
#  port [Port]
#  user [User/Email]
#  password [Password]
#  from [User/Email]
#  to [Recipient]
#  subject 'Error alert fluentd'
#  message Error occured %s times
#  message_out_keys count
#</match>