diff --git a/_modules/heka_alarming.py b/_modules/heka_alarming.py
index f408c9b..fe5b3b4 100644
--- a/_modules/heka_alarming.py
+++ b/_modules/heka_alarming.py
@@ -7,7 +7,7 @@
                           'no_alerting', 'tag_fields')
 
 
-def message_matcher(alarm, triggers):
+def alarm_message_matcher(alarm, triggers):
     """
     Return an Heka message matcher expression for a given alarm and a
     dict of triggers.
@@ -26,6 +26,26 @@
     return ' || '.join(matchers)
 
 
+def alarm_cluster_message_matcher(alarm_cluster):
+    """
+    Return an Heka message matcher expression for a given alarm cluster.
+
+    For example the function may return this:
+
+        Fields[service] == 'rabbitmq-cluster'
+    """
+    matchers = set()
+    match_items = alarm_cluster.get('match', {}).items()
+    for match_name, match_value in match_items:
+        matcher = "Fields[{}] == '{}'".format(match_name, match_value)
+        matchers.add(matcher)
+    match_items = alarm_cluster.get('match_re', {}).items()
+    for match_name, match_value in match_items:
+        matcher = "Fields[{}] =~ /{}/".format(match_name, match_value)
+        matchers.add(matcher)
+    return ' && '.join(matchers)
+
+
 def dimensions(alarm):
     """
     Return a dict alarm dimensions. Each dimension is validated, and an
diff --git a/heka/_service.sls b/heka/_service.sls
index 5febf5c..c1c85ed 100644
--- a/heka/_service.sls
+++ b/heka/_service.sls
@@ -299,6 +299,22 @@
 
 {%- for alarm_cluster_name, alarm_cluster in service_metadata.get('alarm_cluster', {}).iteritems() %}
 
+/etc/{{ service_name }}/filter_gse_{{ alarm_cluster_name }}.toml:
+  file.managed:
+  - source: salt://heka/files/toml/filter/gse_alarm_cluster.toml
+  - template: jinja
+  - mode: 640
+  - group: heka
+  - require:
+    - file: heka_{{ service_name }}_conf_dir
+  - require_in:
+    - file: heka_{{ service_name }}_conf_dir_clean
+  - watch_in:
+    - service: heka_{{ service_name }}_service
+  - defaults:
+      alarm_cluster_name: {{ alarm_cluster_name }}
+      alarm_cluster: {{ alarm_cluster|yaml }}
+
 /usr/share/lma_collector/common/gse_{{ alarm_cluster_name|replace('-', '_') }}_topology.lua:
   file.managed:
   - source: salt://heka/files/gse_topology.lua
diff --git a/heka/files/toml/filter/afd_alarm.toml b/heka/files/toml/filter/afd_alarm.toml
index ee4f36b..c1168df 100644
--- a/heka/files/toml/filter/afd_alarm.toml
+++ b/heka/files/toml/filter/afd_alarm.toml
@@ -2,7 +2,7 @@
 type = "SandboxFilter"
 filename = "/usr/share/lma_collector/filters/afd.lua"
 preserve_data = {{ alarm.preserve_data|default(False)|lower }}
-message_matcher = "(Type == 'metric' || Type == 'heka.sandbox.metric') && ({{ salt['heka_alarming.message_matcher'](alarm, trigger) }})"
+message_matcher = "(Type == 'metric' || Type == 'heka.sandbox.metric') && ({{ salt['heka_alarming.alarm_message_matcher'](alarm, trigger) }})"
 module_directory = "/usr/share/lma_collector/common;/usr/share/heka/lua_modules"
 ticker_interval = 10
 
diff --git a/heka/files/toml/filter/gse_alarm_cluster.toml b/heka/files/toml/filter/gse_alarm_cluster.toml
new file mode 100644
index 0000000..375674a
--- /dev/null
+++ b/heka/files/toml/filter/gse_alarm_cluster.toml
@@ -0,0 +1,20 @@
+[gse_{{ alarm_cluster_name }}_filter]
+type = "SandboxFilter"
+filename = "/usr/share/lma_collector/filters/gse_cluster_filter.lua"
+preserve_data = {{ alarm_cluster.preserve_data|default(False)|lower }}
+message_matcher = "(Type == 'heka.sandbox.afd_metric' || Type == 'heka.sandbox.gse_metric') && ({{ salt['heka_alarming.alarm_cluster_message_matcher'](alarm_cluster) }})"
+module_directory = "/usr/share/lma_collector/common;/usr/share/heka/lua_modules"
+ticker_interval = 1
+
+[gse_{{ alarm_cluster_name }}_filter.config]
+topology_file = "gse_{{ alarm_cluster_name|replace('-', '_') }}_topology"
+activate_alerting = {{ alarm_cluster.alerting|default(True)|lower }}
+{%- if alarm_cluster.interval is defined %}
+interval = {{ alarm_cluster.interval }}
+{%- endif %}
+{%- if alarm_cluster.max_inject is defined %}
+max_inject = {{ alarm_cluster.max_inject }}
+{%- endif %}
+{%- if alarm_cluster.warm_up_period is defined %}
+warm_up_period = {{ alarm_cluster.warm_up_period }}
+{%- endif %}