Sensu のイベントデータを fluentd + Treasuredata + Google Spreadsheet で集計する環境を作ってみる

cd /etc/sensu/handlers
curl -k -o fluentd.rb https://raw.githubusercontent.com/sensu/sensu-community-plugins/master/handlers/notification/fluentd.rb
chmod 755 fluentd.rb
cd /etc/sensu/conf.d/
curl -k -s -o fluentd.json https://raw.githubusercontent.com/sensu/sensu-community-plugins/master/handlers/notification/fluentd.json

{
  "fluentd": {
    "host": "localhost",
    "port": 9880,
    "tag_prefix": "sensu-event"
  }
}

  "handlers": {
    "default": {
      "type": "set",
      "handlers": [
        "stdout",
        "fluentd" // 追加
      ]
    },
    "stdout": {
      "type": "pipe",
      "command": "cat"
    },
    "fluentd": { // 追加
      "type": "pipe", // 追加
      "command": "/etc/sensu/handlers/fluentd.rb" // 追加
    }
  },
  "checks": {
    "test": {
      "handlers": ["default"], // 追加
      "command": "echo -n OK",
      "subscribers": [
        "test"
      ],
      "interval": 60
    }

<source>
  type http
  port 9880
  bind 0.0.0.0
  body_size_limit 32m
  keepalive_timeout 10s
</source>

<source>
  type tail
  format json
  path /var/log/sensu/sensu-server.log
  tag sensu.streame
  pos_file /tmp/fluentd.pos
</source>

<match sensu.*>
  type copy

  <store>
    type file
    path /tmp/sensu.log
  </store>

  <store>
    type tdlog
    apikey ${API KEY}
    auto_create_table
    buffer_type file
    buffer_path /var/log/td-agent/buffer/sensu
    use_ssl true
  </store>
</match>

<match sensu-event.*>
  type copy

  <store>
    type file
    path /tmp/sensu-event.log
  </store>

  <store>
    type tdlog
    apikey ${API KEY}
    auto_create_table
    buffer_type file
    buffer_path /var/log/td-agent/buffer/sensu-event
    use_ssl true
  </store>
</match>

SELECT 
  COUNT(*)
FROM
  alert
WHERE
  client = "sensu-client4"

SELECT 
  COUNT(*)
FROM
  alert
WHERE
  ACTION = "ALERT"