filter-50-lmtp.conf

filter {
  if [postfix][component] == "lmtp" {
    grok {
      match => ["message","to=<%{DATA:[destination][user][email]}>(, orig_to=<%{DATA:[postfix][orig_to]}>)?, relay=%{HOSTNAME:[server][address]}\[%{IP:[server][ip]}\]:%{NUMBER:[server][port]:int}, delay=%{NUMBER:[postfix][delay]:float}, delays=%{DATA:[postfix][delays]}, dsn=%{DATA:[postfix][dsn]}, status=%{WORD:[postfix][status]} \(%{GREEDYDATA:[postfix][detail]}\)"]
      id => "postfix_lmtp"
      tag_on_failure => ["_grokparsefailure","postfix_lmtp_failed"]
      add_field => {
        "[postfix][eventtype]" => "lmtp_to"
      }
      add_tag => "grokked"
    }
  }
}