<source> @type tail path /var/log/cron-apt/log pos_file /var/log/td-agent/cron-apt.pos format none tag cron_apt </source> <filter cron_apt> @type grep <regexp> key message pattern (^CRON-APT RUN|not upgraded\.) </regexp> </filter> <filter cron_apt> @type record_transformer <record> hostname ${hostname} message ${hostname}: ${record["message"]} </record> </filter> <match cron_apt> @type relabel @label @forward </match>