<filter foo.bar.*>
  type script
  path /etc/fluentd/example.rb
</filter>

def start
  super
  # This is the first method to be called when it starts running
  # Use it to allocate resources, etc.
end
def shutdown
  super
  # This method is called when Fluentd is shutting down.
  # Use it to free up resources, etc.
end
def filter(tag, time, record)
  # This method implements the filtering logic for individual filters
  record
end

def filter(tag, time, record)
  case tag
  when /.+\.code$/
    code(record)
  when /.+\.msg$/
    message(record)
  end
end
def code(record)
  if record.has_key?("key1")
    record["code"] = record["key1"].to_i
    record.delete("key1")
  end
  record
end
def message(record)
  case record["key2"].to_i
  when 100..200
    level = "INFO"
  when 201..300
    level = "WARN"
  else
    level = "ERROR"
  end
  record.delete("key2")
  record["message"] = level + ":" + record["key3"]
  record.delete("key3")
  record
end

foo.bar.code: {"key1": "200"}

foo.bar.code: {"code":200}

foo.bar.msg: {"key2":280,"key3":"Something happend."}

foo.bar.msg: {"message":"WARN:Something happend."}