Tombar

  grok {
    tags    => "postfix/smtpd"
    pattern => [  "%{POSTFIXSMTPDCONNECTS}",
                  "%{POSTFIXSMTPDACTIONS}",
                  "%{POSTFIXSMTPDTIMEOUTS}",
                  "%{POSTFIXSMTPDLOGIN}",
                  "." ]
    named_captures_only => true
  }

Tombar

# Postfix stuff
QUEUEID (?:[A-F0-9]+|NOQUEUE)
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote}
RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?::[0-9]+(.[0-9]+)?)?)?)
#RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?:%{POSREAL:relayport})))
POSREAL [0-9]+(.[0-9]+)?
#DELAYS %{POSREAL:a}/%{POSREAL:b}/%{POSREAL:c}/%{POSREAL:d}
DELAYS (%{POSREAL}[/]*)+
DSN %{NONNEGINT}.%{NONNEGINT}.%{NONNEGINT}