Search-ESsearcher/logstash/conf.d/51-filter-postfix-aggregate...

39 lines
1.0 KiB
Plaintext

filter {
if ![postfix_queueid] {
drop {}
} else if [program] == "postfix/qmgr" and [postfix_from]{
aggregate {
task_id => "%{postfix_queueid}"
code => "
map['postfix_from'] = event.get('postfix_from')
map['postfix_size'] = event.get('postfix_size')
map['postfix_nrcpt'] = event.get('postfix_nrcpt')
"
}
} else if [program] == "postfix/smtpd" {
aggregate {
task_id => "%{postfix_queueid}"
code => "
map['postfix_client_hostname'] = event.get('postfix_client_hostname')
map['postfix_client_ip'] = event.get('postfix_client_ip')
"
}
} else if [program] == "postfix/cleanup" {
aggregate {
task_id => "%{postfix_queueid}"
code => "
map['postfix_message-id'] = event.get('postfix_message-id')
"
}
} else if [program] == "postfix/smtp" {
aggregate {
task_id => "%{postfix_queueid}"
code => "
map.each do |key, value|
event.set(key, value)
end
"
}
}
}