td-agent.conf

<match changefinder.**>
  @type copy
  deep_copy true

  <store>
    @type norikra
    norikra localhost:26571
    remove_tag_prefix changefinder
    target_map_tag true
  </store>

  <store>
    @type record_reformer

    renew_record true
    renew_time_key time

    tag datadog.${tag}
    <record>
      metric ${metric_outlier}
      tag ${scope}
      host ${host}
      value ${score_outlier}
      time ${record["time"]}
    </record>
  </store>

  <store>
    @type record_reformer

    renew_record true
    renew_time_key time

    tag datadog.${tag}
    <record>
      metric ${metric_change}
      tag ${scope}
      host ${host}
      value ${score_change}
      time ${record["time"]}
    </record>
  </store>

</match>

<match replay.changefinder.**>
  @type copy
  deep_copy true

  <store>
    @type norikra
    norikra localhost:26571
    buffer_queue_limit 3
    retry_limit 1
    remove_tag_prefix replay.changefinder
    target_map_tag true
  </store>

</match>

<match datadog.changefinder.**>
  @type dd
  dd_api_key YOUR_DD_API_KEY

  flush_interval 2s
  queued_chunk_flush_interval 1s
  try_flush_interval 0.1
  num_threads 4
  disable_retry_limit true
  max_retry_wait 30s
</match>

<source>
  type norikra
  norikra localhost:26571

  <fetch>
    method event
    target sample_anomaly
    tag query_name
    tag_prefix norikra.query.anomaly
    interval 10s
  </fetch>

  <fetch>
    method event
    target sample_replay
    tag query_name
    tag_prefix norikra.query.replay
    interval 10s
  </fetch>

</source>

<match norikra.query.anomaly.**>
  @type slack

  flush_interval 10s

  api_key YOUR_DD_API_KEY
  app_key YOUR_DD_APP_KEY

  webhook_url https://hooks.slack.com/services/XXX/XXX/XXX

  channel dev-alerts-anomaly
  username "Mr. ChangeFinder"
  icon_emoji :ghost:

  message_keys min_time,max_time,metric,raw,change,outlier
  message ":clock1: [%s, %s]\n:house: %s\n:chart_with_upwards_trend: Max Raw %s, Max Change %s, Max Outlier %s"
</match>

<match norikra.query.replay.**>
  @type slack

  flush_interval 10s

  api_key YOUR_DD_API_KEY
  app_key YOUR_DD_APP_KEY

  webhook_url https://hooks.slack.com/services/XXX/XXX/XXX

  channel dev-alerts-anomaly
  username "Mr. ChangeFinder (replay)"
  icon_emoji :innocent:

  message_keys min_time,max_time,metric,raw,change,outlier
  message ":clock1: [%s, %s]\n:house: %s\n:chart_with_upwards_trend: Max Raw %s, Max Change %s, Max Outlier %s"
</match>