rgevaert

  grok {
    tags    => "postfix/smtpd"
    pattern => [  "%{POSTFIXSMTPDCONNECTS}",
                  "%{POSTFIXSMTPDACTIONS}",
                  "%{POSTFIXSMTPDTIMEOUTS}",
                  "%{POSTFIXSMTPDLOGIN}",
                  "." ]
    named_captures_only => true
  }