postfix_patterns

# Postfix stuff
QUEUEID (?:[A-F0-9]+|NOQUEUE)
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:postfix_local}@%{EMAILADDRESSPART:postfix_remote}
RELAY (?:%{HOSTNAME:postfix_relayhost}(?:\[%{IP:postfix_relayip}\](?::[0-9]+(.[0-9]+)?)?)?)
#RELAY (?:%{HOSTNAME:postfix_relayhost}(?:\[%{IP:postfix_relayip}\](?:%{POSREAL:postfix_relayport})))
POSREAL [0-9]+(.[0-9]+)?
#DELAYS %{POSREAL:a}/%{POSREAL:b}/%{POSREAL:c}/%{POSREAL:d}
DELAYS (%{POSREAL}[/]*)+
DSN %{NONNEGINT}.%{NONNEGINT}.%{NONNEGINT}
STATUS sent|deferred|bounced|expired
PERMERROR 5[0-9]{2}
MESSAGELEVEL reject|warning|error|fatal|panic

POSTFIXSMTPMESSAGE %{MESSAGELEVEL}: %{GREEDYDATA:postfix_reason}
POSTFIXACTION discard|dunno|filter|hold|ignore|info|prepend|redirect|replace|reject|warn

# postfix/smtp and postfix/lmtp and postfix/local
POSTFIXSMTPRELAY %{QUEUEID:postfix_qid}: to=<%{EMAILADDRESS:postfix_to}>,(?:\sorig_to=<%{EMAILADDRESS:postfix_orig_to}>,)? relay=%{RELAY}, delay=%{POSREAL:postfix_delay}, delays=%{DELAYS:postfix_delays}, dsn=%{DSN}, status=%{STATUS:postfix_result} \(%{DATA:postfix_reason}\)
POSTFIXSMTPCONNECT connect to %{RELAY}: %{GREEDYDATA:postfix_reason}
POSTFIXSMTP5XX %{QUEUEID:postfix_qid}: to=<%{EMAILADDRESS:postfix_to}>,(?:\sorig_to=<%{EMAILADDRESS:postfix_orig_to}>,)? relay=%{RELAY}, delay=%{POSREAL:postfix_delay}, delays=%{DELAYS:postfix_delays}, dsn=%{DSN}, status=%{STATUS:postfix_result} \(host %{HOSTNAME}\[%{IP}\] said: %{PERMERROR:postfix_responsecode} %{DATA:postfix_smtp_response} \(in reply to %{DATA:postfix_command} command\)\)
POSTFIXSMTPREFUSAL %{QUEUEID:postfix_qid}: host %{RELAY} refused to talk to me: %{GREEDYDATA:postfix_reason}
POSTFIXSMTPLOSTCONNECTION %{QUEUEID:postfix_qid}: lost connection with %{RELAY} while %{GREEDYDATA:postfix_reason}
POSTFIXSMTPTIMEOUT %{QUEUEID:postfix_qid}: conversation with %{RELAY} timed out while %{GREEDYDATA:postfix_reason}

# postfix/smtpd
POSTFIXSMTPDCONNECTS (?:dis)?connect from %{RELAY}
# POSTFIXSMTPDACTIONS %{QUEUEID:postfix_qid}: %{POSTFIXACTION}: %{DATA:postfix_command} from %{RELAY}: %{DATA:postfix_smtp_response}: %{DATA:postfix_reason}; from=<%{EMAILADDRESS:postfix_from}> to=<%{EMAILADDRESS:postfix_to} proto=%{DATA:postfix_proto} helo=<%{IPORHOST}>
POSTFIXSMTPDACTIONS %{QUEUEID:postfix_qid}: %{POSTFIXACTION}: %{DATA:postfix_command} from %{RELAY}: %{DATA:postfix_smtp_response}: %{DATA:postfix_reason}; from=<%{EMAILADDRESS:postfix_from}> to=<%{EMAILADDRESS:postfix_to}> proto=%{DATA:postfix_proto} helo=<%{IPORHOST}>
POSTFIXSMTPDTIMEOUTS timeout after %{DATA:postfix_command} from %{RELAY}
POSTFIXSMTPDLOGIN %{QUEUEID:postfix_qid}: client=%{DATA:postfix_client}, sasl_method=%{DATA:postfix_saslmethod}, sasl_username=%{EMAILADDRESS:postfix_saslusername}

# postfix/cleanup
POSTFIXCLEANUP %{QUEUEID:postfix_qid}: message-id=<%{EMAILADDRESS:postfix_messageid}>

# postfix/virtual
POSTFIXVIRTUAL %{QUEUEID:postfix_qid}: to=<%{EMAILADDRESS:postfix_to}>, relay=virtual, delay=%{POSREAL:postfix_delay}, delays=%{DELAYS:postfix_delays}, dsn=%{DSN}, status=%{STATUS:postfix_result} \(%{DATA:postfix_reason}\)

# postfix/bounce
POSTFIXBOUNCE %{QUEUEID:postfix_qid}: sender non-delivery notification: %{QUEUEID:postfix_bouncequeueid}

# postfix/qmgr and postfix/pickup
POSTFIXQMGR %{QUEUEID:postfix_qid}: (?:removed|from=<(?:%{EMAILADDRESS:postfix_from})?>(?:, size=%{POSINT:postfix_size}, nrcpt=%{POSINT:postfix_nrcpt} \(%{GREEDYDATA:postfix_queuestatus}\))?)

# postfix/anvil
POSTFIXANVIL statistics: %{DATA:postfix_anvilstatistic} for (%{DATA:postfix_remotehost}) at %{SYSLOGTIMESTAMP:postfix_timestamp}