filter-50-smtpd.conf

filter {
  if [postfix][component] == "smtpd" {

    # matches connect from and disconnect from
    # not very efficient to check every log this way
    # contributions with better checks are very welcome :-)
    if [message] =~ /connect from/ {
      grok {
        match => ["message","(dis)?connect from %{HOSTNAME:[client][address]}\[%{IP:[client][ip]}\](%{GREEDYDATA:[@metadata][connectdetail]})?"]
        id => "postfix_smtpd_connect"
        tag_on_failure => ["_grokparsefailure","postfix_smtpd_connect_failed"]
        add_field => {
          "[postfix][eventtype]" => "smtpd_connect"
        }
        add_tag => "grokked"
      }

    }

    if [message] =~ /^lost connection after/ {
      grok {
        match => ["message","lost connection after %{WORD:[postfix][action]} from %{HOSTNAME:[client][address]}\[%{IP:[client][ip]}\]"]
        id => "postfix_smtpd_lostconnection"
        tag_on_failure => ["_grokparsefailure","postfix_smtpd_lostconnection"]
        add_field => {
          "[postfix][eventtype]" => "smtpd_lostconnection"
        }
        add_tag => "grokked"
      }
    }

    if [message] =~ /^client=/ {
      grok {
        match => ["message","client=%{HOSTNAME:[client][address]}\[%{IP:[client][ip]}\]"]
        id => "postfix_smtpd_client"
        tag_on_failure => ["_grokparsefailure","postfix_smtpd_client"]
        add_field => {
          "[postfix][eventtype]" => "smtpd_client"
        }
        add_tag => "grokked"
      }
    }

    if [message] =~ /^Anonymous TLS connection established from/ {
      grok {
        match => ["message","Anonymous TLS connection established from %{HOSTNAME:[client][domain]}\[%{IP:[client][address]}\]: %{GREEDYDATA:[postfix][detail]}"]
        id => "postfix_smtpd_anontls"
        tag_on_failure => ["_grokparsefailure","postfix_smtpd_anontls"]
        add_field => {
          "[postfix][eventtype]" => "smtpd_anontls"
        }
        add_tag => "grokked"
      }
    }

    if [@metadata][connectdetail] {
      kv {
        source => "[@metadata][connectdetail]"
        target => "[postfix]"
      }
    }
  }
}