diff --git a/_modules/heka_alarming.py b/_modules/heka_alarming.py
index f408c9b..fe5b3b4 100644
--- a/_modules/heka_alarming.py
+++ b/_modules/heka_alarming.py
@@ -7,7 +7,7 @@
                           'no_alerting', 'tag_fields')
 
 
-def message_matcher(alarm, triggers):
+def alarm_message_matcher(alarm, triggers):
     """
     Return an Heka message matcher expression for a given alarm and a
     dict of triggers.
@@ -26,6 +26,26 @@
     return ' || '.join(matchers)
 
 
+def alarm_cluster_message_matcher(alarm_cluster):
+    """
+    Return an Heka message matcher expression for a given alarm cluster.
+
+    For example the function may return this:
+
+        Fields[service] == 'rabbitmq-cluster'
+    """
+    matchers = set()
+    match_items = alarm_cluster.get('match', {}).items()
+    for match_name, match_value in match_items:
+        matcher = "Fields[{}] == '{}'".format(match_name, match_value)
+        matchers.add(matcher)
+    match_items = alarm_cluster.get('match_re', {}).items()
+    for match_name, match_value in match_items:
+        matcher = "Fields[{}] =~ /{}/".format(match_name, match_value)
+        matchers.add(matcher)
+    return ' && '.join(matchers)
+
+
 def dimensions(alarm):
     """
     Return a dict alarm dimensions. Each dimension is validated, and an