Skip to content

Instantly share code, notes, and snippets.

@tkorkunckaya
Forked from jamtur01/postfix_patterns
Last active December 12, 2015 01:29
Show Gist options
  • Save tkorkunckaya/4691822 to your computer and use it in GitHub Desktop.
Save tkorkunckaya/4691822 to your computer and use it in GitHub Desktop.
Postfix patterns file for logstash
QUEUEID (?:[A-F0-9]+|NOQUEUE)
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote}
RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?::%{POSREAL:relayport})?)?)
POSREAL [0-9]+(.[0-9]+)?
DELAYS %{POSREAL:a}/%{POSREAL:b}/%{POSREAL:c}/%{POSREAL:d}
DSN %{POSINT}.%{POSINT}.%{POSINT}
STATUS sent|deferred|bounced|expired
PERMERROR 5[0-9]{2}
MESSAGELEVEL reject|warning|error|fatal|panic
## tolga 2 ek
GREEDYDATA .*
QUOTEDSTRING (?:(?<!\\)(?:"(?:\\.|[^\\"])*"|(?:'(?:\\.|[^\\'])*')|(?:`(?:\\.|[^\\`])*`)))
# postfix/bounce
POSTFIXBOUNCE %{SYSLOGPROG}: %{QUEUEID}: to=<%{EMAILADDRESS:to}>, relay=%{RELAY}, delay=%{POSREAL:delay}, delays=%{DELAYS}, dsn=%{DSN}, status=%{STATUS} \(%{GREEDYDATA:reason}\)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment