fluentdでmaillogのparserやるとしたら。ただこれエラー処理によって結構変わってくる気がするわ

after json

{"host"=>"hogehoge", "process"=>"postfix/cleanup[20095]", "key"=>"DFFBB46431A", "address"=>"hoge@example.com", "orig_to"=>"hoge", "relay"=>"none", "delay"=>"0.03", "delays"=>"0.03/0/0/0", "dsn"=>"5.7.1", "status"=>"bounced (message content rejected)"}

format

/^(?<time>\w{3}  \d+ (\d+:){2}\d+) (?<host>[^ ]+) (?<process>[^:]+): (?<key>[^:]+): ?((to|from)=<(?<address>[^>]+)>)?, ?(orig_to=<(?<orig_to>[^>]+)>), ?(relay=(?<relay>[^ ]+)), ?(delay=(?<delay>[^ ]+)), ?(delays=(?<delays>[^ ]+)), ?(dsn=(?<dsn>[^ ]+)), ?(status=(?<status>[^,]+))/

logfile

Jan  6 20:30:02 hogehoge postfix/cleanup[20095]: DFFBB46431A: to=<hoge@example.com>, orig_to=<hoge>, relay=none, delay=0.03, delays=0.03/0/0/0, dsn=5.7.1, status=bounced (message content rejected)