{"repo":"whyscream/postfix-grok-patterns","free":true,"listed":false,"github":"https://github.com/whyscream/postfix-grok-patterns","clone":"git clone https://github.com/whyscream/postfix-grok-patterns.git","description":"Logstash configuration and grok patterns for parsing postfix logging","language":"Shell","stars":286,"topics":["logging","logstash","postfix","grok"],"license":"BSD-3-Clause","category":"analytics","readme_excerpt":"Logstash grok patterns for postfix logging ========================================== A set of grok patterns for parsing postfix logging using grok. Also included is a sample Logstash config file for applying the grok patterns as a filter. Usage ----- - Install logstash - Add 50-filter-postfix.conf to /etc/logstash/conf.d or pipeline dir for dockerized Logstash - Make dir /etc/logstash/patterns.d - Add postfix.grok to /etc/logstash/patterns.d - Restart logstash The included Logstash config file requires two input fields to exist in input events: - program : the name of the program that generated the log line, f.i. postfix/smtpd (named tag in syslog lingo) - message : the log message payload without additional fields (program, pid, etc), f.i. connect from 1234.static.ctinets.com[45.238.241.123] This event format is supported by the Logstash syslog input plugin out of the box, but several other plugins produce input that can be adapted fairly easy to produce these fields too. See ALTERNATIVE INPUTS for details. Tests ----- In the test/ directory, there is a test suite that tries to make sure that no previously supported log line will break because of changing common patterns and such. It also returns results a lot faster than doing sudo service logstash restart :-). The test suite needs the patterns provided by Logstash, you can easily pull these from github by running git submodule update --init . To run the test suite, you need a recent version of ruby ( 2.6 or newer should w","default_branch":null,"files":null,"tree":[],"storefront":"/r/whyscream","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/whyscream/postfix-grok-patterns/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}