@type tail path /var/log/cron-apt/log pos_file /var/log/td-agent/cron-apt.pos format none tag cron_apt @type grep key message pattern (^CRON-APT RUN|not upgraded\.) @type record_transformer hostname ${hostname} message ${hostname}: ${record["message"]} @type relabel @label @forward