We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent ed4d7ae commit 78af96eCopy full SHA for 78af96e
filter-50-local.conf
@@ -1,7 +1,7 @@
1
filter {
2
if [postfix][component] == "local" {
3
grok {
4
- match => ["message","to=<%{DATA:[destination][user][email]}>, relay=%{HOSTNAME:[postfix][relay]}, delay=%{NUMBER:[postfix][delay]:float}, delays=%{DATA:[postfix][delays]}, dsn=%{DATA:[postfix][dsn]}, status=%{WORD:[postfix][status]} \(%{GREEDYDATA:[postfix][detail]}\)"]
+ match => ["message","to=<%{DATA:[destination][user][email]}>(, orig_to=<%{DATA:[postfix][orig_to]}>)?, relay=%{HOSTNAME:[postfix][relay]}, delay=%{NUMBER:[postfix][delay]:float}, delays=%{DATA:[postfix][delays]}, dsn=%{DATA:[postfix][dsn]}, status=%{WORD:[postfix][status]} \(%{GREEDYDATA:[postfix][detail]}\)"]
5
id => "postfix_local"
6
tag_on_failure => ["_grokparsefailure","postfix_local_failed"]
7
add_field => {
0 commit comments