From dcef00935330965b35707be0d9d22630a549aa15 Mon Sep 17 00:00:00 2001
From: "Dustin C. Hatch" <dustin@hatch.name>
Date: Tue, 5 Aug 2025 07:25:59 -0500
Subject: [PATCH] fluent-bit: send md alerts to ntfy

For machines that have Linux MD RAID arrays, I want to receive
notifications about the status of the arrays immediately via _ntfy_.  I
had this before with `journal2ntfy`, but I never got around to setting
it up for the current generation of machines (_nvr2_, _chromie_).  Now
that we have `fluent-bit` deployed, we can use its pipeline capabilities
to select the subset of messages for which we want immediate alerts and
send them directly to _ntfy_.  We use a Lua function to transform the
log record into a body compatible with _ntfy_'s JSON publish request;
`fluent-bit` doesn't have any other way to set array values, as needed
for the `tags` member.
---
 group_vars/all.yml | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/group_vars/all.yml b/group_vars/all.yml
index ec31b0f..e34d219 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -147,6 +147,34 @@ fluent_bit_filters:
 - name: grep
   match: host.fluent-bit.service
   exclude: message \[output:http:victorialogs\] .+, HTTP status=200$
+- name: rewrite_tag
+  alias: ntfy
+  match: host.*
+  rule: transport kernel ntfy true
+- name: grep
+  match: ntfy
+  alias: ntfy.filter
+  regex: message ^md
+- name: lua
+  alias: ntfy.populate
+  match: ntfy
+  code: |
+    function ntfy_transform(tag, timestamp, record)
+        record["topic"] = "alerts"
+        record["tags"] = {
+          record["hostname"],
+          record["syslog_identifier"],
+        }
+        return 1, timestamp, record
+    end
+  call: ntfy_transform
+- name: record_modifier
+  alias: ntfy.clean
+  match: ntfy
+  allowlist_key:
+  - message
+  - tags
+  - topic
 fluent_bit_outputs:
 - name: http
   alias: victorialogs
@@ -161,3 +189,16 @@ fluent_bit_outputs:
   format: json_lines
   json_date_format: iso8601
   log_response_payload: false
+- name: http
+  alias: ntfy
+  workers: 1
+  match: ntfy
+  host: ntfy.pyrocufflink.blue
+  port: 443
+  tls: true
+  tls.verify: true
+  tls.verify_hostname: true
+  uri: /
+  format: json_lines
+  json_date_key: false
+  log_response_payload: false