Logstash indexer config for parsing postfix logs

logstash_postfix_indexer.conf

# We will focus only on how to parse the records
filter {

  # Split postfix record to basic parts
  grok {
    type                => 'postfix'
    pattern             => '%{SYSLOGBASE}'
    named_captures_only => true
  }

  # Split by spaces, trim colons and brackets
  kv {
    type        => 'postfix'
    field_split => ' '
    trim        => '<>,'
    source      => "@message"
  }
}