adds rules for notification logs

[Crited]

refers to #15

[widhalmt]

Plese do not use CamelCase in field names. They all should be written in lowercase.

match => ["message","Type '%{WORD:[icinga][notificationtype]}', TypeFilter: %{DATA:[icinga][TypeFilter]}\(%{WORD}=%{NUMBER:[notification][FType]}, %{WORD}=%{NUMBER:[notification][TypeFilter]}\)"]

[Crited]

Adjusted to be compliant with all lowercase-structure. My bad.

[widhalmt]

Sorry, there's another change that must have slipped my attention in the first place. Please make all fields subfields of icinga . So please change [notification] to [icinga][notification].

[Crited]

This has been stalled for a while, because of the tactical decision we had to tackle, regarding arrays, that has been resolved by this documentation update: #37

I've updated this, so we don't use arrays here either. Hope that does the trick.

[widhalmt]

That's a big one. Great!