start rules for "checkable" logs

helps with #14

filter-50-checkable.conf

@@ -0,0 +1,16 @@
+filter {
+  if [icinga][facility] == "Checkable" {
+    if [message] =~ /^Notifications are disabled for/ {
+      grok {
+        match => ["message","Notifications are disabled for %{WORD:[icinga][objecttype]} '%{DATA:[icinga][object]}'."]
+        id => "icinga_notificationsdisabled"
+        add_tag => "icinga_notificationsdisabled"
+        tag_on_failure => ["_grokparsefailure","icinga_notificationsdisabled_failed"]
+        add_field => {
+          "[icinga][eventtype]" => "notificationsdisabled"
+        }
+      }
+    }
+  }
+}
+