mail.conf

filter {
  if [type] == "mail" {
    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXSMTPD}" ]
      add_tag => ["vhosting_mail", "postfix_smtpd"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXSMTP}" ]
      add_tag => ["vhosting_mail", "postfix_smtp"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXCLEANUP}" ]
      add_tag => ["vhosting_mail", "postfix_cleanup"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXANVIL}" ]
      add_tag => ["vhosting_mail", "postfix_anvil"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXQMGR}" ]
      add_tag => ["vhosting_mail", "postfix_qmgr"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXBOUNCE}" ]
      add_tag => ["vhosting_mail", "postfix_bounce"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXRELAY}" ]
      add_tag => ["vhosting_mail", "postfix_relay"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{POSTFIXPOLICY}" ]
      add_tag => ["vhosting_mail", "postfix_policy"]
    }

    grok {
      patterns_dir => "/home/wido/logstash/patterns"
      match => [ "message", "%{DOVECOT}" ]
      add_tag => ["vhosting_mail", "dovecot"]
    }

    if "vhosting_mail" not in [tags] {
      grok {
        match => [ "message", "%{SYSLOGBASE}" ]
        add_tag => ["vhosting_mail", "postfix_syslog"]
      }
    } else {
      if [clientip] {
        mutate {
          add_field => {
            "remote" => "%{clientip}"
          }
        }
      }
    }

    if "vhosting_mail" in [tags] {
      mutate {
        remove_tag => ["_grokparsefailure"]
        remove_field => ["timestamp"]
      }

      date {
        timezone => "Europe/Amsterdam"
        match => ["timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
      }
    }
  }
}