fluentd.conf

<source>
  @type syslog
  port  1514
  bind  0.0.0.0
  tag   syslog
</source>

<match syslog.**>
  @type rewrite_tag_filter
  <rule>
    key     message
    pattern ^{".+}$
    tag     json_message
  </rule>
  <rule>
    key     message
    pattern .+
    tag     raw_message
  </rule>
</match>

<filter raw_message>
  @type        record_transformer
  renew_record true
  keep_keys    message
  <record>
    app_name ${record["ident"]}
  </record>
</filter>

<match raw_message>
  @type              cloudwatch_logs
  log_group_name     @@LOG_GROUP_NAME@@
  log_stream_name    @@LOG_STREAM_NAME@@
  auto_create_stream true
</match>

<match json_message>
  @type              cloudwatch_logs
  log_group_name     @@LOG_GROUP_NAME@@
  log_stream_name    @@LOG_STREAM_NAME@@
  message_keys       message
  auto_create_stream true
</match>

<source>
  @type udp
  port  1515
  bind  0.0.0.0
  format json
  tag   bigsibling_metrics
</source>

<match bigsibling_metrics.**>
  @type cloudwatch_logs
  log_group_name     tsuru-metrics
  log_stream_name    @@LOG_STREAM_NAME@@
  auto_create_stream true
</match>