grok-patterns

exim

MAIL_USER [\.\+\=\-_a-zA-Z0-9]+
EXIM_MSGID (?<exim_msgid>[0-9A-Za-z]{6}-[0-9A-Za-z]{6}-[0-9A-Za-z]{2})
EXIM_FLAGS (<=|[-=>*]>|[*]{2}|==)
EXIM_DATE %{YEAR:exim_year}-%{MONTHNUM:exim_month}-%{MONTHDAY:exim_day} %{TIME:exim_time}
EXIM_PID \[%{POSINT}\]
EXIM_T ((\d+y)?(\d+w)?(\d+d)?(\d+h)?(\d+m)?(\d+s)?)
EXIM_QT QT=%{EXIM_T:exim_qt}
EXIM_DT DT=%{EXIM_T:exim_dt}
EXIM_EXCLUDE_TERMS (Message is frozen|(Start|End) queue run| Warning: | retry time not reached | no (IP address|host name) found for (IP address|host) | unexpected disconnection while reading SMTP command | no immediate delivery: |another process is handling this message)
EXIM_REMOTE_HOST (H=|from\s|host\s)(%{NOTSPACE:exim_remote_hostname} )?(\(%{NOTSPACE:exim_remote_heloname}\) )?\[%{IP:exim_remote_host}\](:%{INT:exim_remote_port})?
EXIM_INTERFACE (I=\[%{IP:exim_interface}\](:%{NUMBER:exim_interface_port}))
EXIM_PROTOCOL (P=%{NOTSPACE:exim_protocol})
EXIM_MSG_SIZE (S=%{NUMBER:exim_msg_size})
EXIM_HEADER_ID (id=%{NOTSPACE:exim_header_id})
EXIM_SUBJECT (T=%{QS:exim_subject})
EXIM_MAIL <>|<?%{MAIL_USER:exim_mail_user}(@%{HOST:exim_mail_domain})?>?
EXIM_TLS_INFO X=%{NOTSPACE:exim_tls_info}
EXIM_DN DN=["'](?<exim_dn>.*?)['"]
EXIM_SMTP_CONFIRMATION C=["'](?<exim_smtp_confirmation>.*?)['"]