Skip to content

Postfix

Description

Product: Postfix

Log type(s): mx

Log sample

Parsing strategy

  1. Check if the log starts with a Postfix header: [postfix/qmgr[11981]] (where [qmgr] is [[app][name]])
  2. A [switch/case] on [[app][name]]
  3. A grok pattern dedicated to each [[app][name]] (the grok file is [punch/patterns/postfix.grok])
  4. The binding to normalized fields

Note: The grok variable mapping is [document:[init][group][name]] \<=> [%{USERNAME:init_group_name}]