gistfile1.txt

  grok {
    tags    => "postfix/smtpd"
    pattern => [  "%{POSTFIXSMTPDCONNECTS}",
                  "%{POSTFIXSMTPDACTIONS}",
                  "%{POSTFIXSMTPDTIMEOUTS}",
                  "%{POSTFIXSMTPDLOGIN}",
                  "." ]
    named_captures_only => true
  }

  grok {
    tags    => "postfix/smtp"
    pattern => [  "%{POSTFIXSMTPRELAY}",
                  "%{POSTFIXSMTPCONNECT}",
                  "%{POSTFIXSMTP5XX}",  
                  "%{POSTFIXSMTPREFUSAL}",
                  "%{POSTFIXSMTPLOSTCONNECTION}",
                  "%{POSTFIXSMTPTIMEOUT}",
                  "." ]
    named_captures_only => true
  }

  grok {
    tags    => "postfix/bounce"
    pattern => "%{POSTFIXBOUNCE}"
    named_captures_only => true
  }

  grok {
    tags    => "postfix/qmgr"
    pattern => "%{POSTFIXQMGR}"
    named_captures_only => true
  }

  grok {
    tags    => "postfix/anvil"
    pattern => "%{POSTFIXANVIL}"
    named_captures_only => true
  }

  grok {
    tags    => "postfix/cleanup"
    pattern => "%{POSTFIXCLEANUP}"
    named_captures_only => true
  }