diff --git a/filter-60-detail.conf b/filter-60-detail.conf new file mode 100644 index 0000000..f081dac --- /dev/null +++ b/filter-60-detail.conf @@ -0,0 +1,17 @@ +filter { + + if [postfix][detail] =~ /^delivered to command/ { + + grok { + match => ["[postfix][detail]","delivered to command:%{SPACE}%{GREEDYDATA:[postfix][delivered][command]}"] + } + + } else if [postfix][detail] =~ /^\d\d\d / { + + grok { + match => ["[postfix][detail]","%{INT:[postfix][delivered][returncode]:string} %{DATA:[postfix][delivered][dsn]} <%{DATA:[postfix][delivered][sender]}> \[InternalId=%{INT:[postfix][delivered][internalid]}, Hostname=%{IPORHOST:[postfix][delivered][hostname]}\] %{INT:[postfix][bytes]:int} bytes in %{NUMBER:[postfix][seconds]:float}, %{NUMBER:[postfix][kbps]:float} KB/sec %{GREEDYDATA:[postfix][delivered][result]}\)"] + } + + } + +}