diff --git a/group_vars/all.yml b/group_vars/all.yml
index ec31b0f..e34d219 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -147,6 +147,34 @@ fluent_bit_filters:
 - name: grep
   match: host.fluent-bit.service
   exclude: message \[output:http:victorialogs\] .+, HTTP status=200$
+- name: rewrite_tag
+  alias: ntfy
+  match: host.*
+  rule: transport kernel ntfy true
+- name: grep
+  match: ntfy
+  alias: ntfy.filter
+  regex: message ^md
+- name: lua
+  alias: ntfy.populate
+  match: ntfy
+  code: |
+    function ntfy_transform(tag, timestamp, record)
+        record["topic"] = "alerts"
+        record["tags"] = {
+          record["hostname"],
+          record["syslog_identifier"],
+        }
+        return 1, timestamp, record
+    end
+  call: ntfy_transform
+- name: record_modifier
+  alias: ntfy.clean
+  match: ntfy
+  allowlist_key:
+  - message
+  - tags
+  - topic
 fluent_bit_outputs:
 - name: http
   alias: victorialogs
@@ -161,3 +189,16 @@ fluent_bit_outputs:
   format: json_lines
   json_date_format: iso8601
   log_response_payload: false
+- name: http
+  alias: ntfy
+  workers: 1
+  match: ntfy
+  host: ntfy.pyrocufflink.blue
+  port: 443
+  tls: true
+  tls.verify: true
+  tls.verify_hostname: true
+  uri: /
+  format: json_lines
+  json_date_key: false
+  log_response_payload: false