Merge pull request #162 from whyscream/support-higher-enhanced-status-codes

Support parsing enhanced status codes that include larger integers.

Author: whyscream

postfix.grok

@@ -7,7 +7,7 @@ POSTFIX_RELAY_INFO %{HOSTNAME:postfix_relay_hostname}?\[(%{IP:postfix_relay_ip}|
 POSTFIX_SMTP_STAGE (CONNECT|HELO|EHLO|STARTTLS|AUTH|MAIL( FROM)?|RCPT( TO)?|(end of )?DATA|RSET|UNKNOWN|END-OF-MESSAGE|VRFY|\.)
 POSTFIX_ACTION (accept|defer|discard|filter|header-redirect|reject)
 POSTFIX_STATUS_CODE \d{3}
-POSTFIX_STATUS_CODE_ENHANCED \d\.\d\.\d
+POSTFIX_STATUS_CODE_ENHANCED \d\.\d+\.\d+
 POSTFIX_DNSBL_MESSAGE Service unavailable; .* \[%{GREEDYDATA:postfix_status_data}\] %{GREEDYDATA:postfix_status_message};
 POSTFIX_PS_ACCESS_ACTION (DISCONNECT|BLACKLISTED|WHITELISTED|WHITELIST VETO|PASS NEW|PASS OLD)
 POSTFIX_PS_VIOLATION (BARE NEWLINE|COMMAND (TIME|COUNT|LENGTH) LIMIT|COMMAND PIPELINING|DNSBL|HANGUP|NON-SMTP COMMAND|PREGREET)

test/smtpd_0030.yaml

@@ -0,0 +1,13 @@
+pattern: ^%{POSTFIX_SMTPD}$
+data: "NOQUEUE: reject: RCPT from 061238241086.static.ctinets.com[61.238.241.86]: 550 5.12.345 <[email protected]>: Recipient address rejected: Some error message; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<ecsolved.com>"
+results:
+    postfix_queueid: NOQUEUE
+    postfix_action: reject
+    postfix_smtp_stage: RCPT
+    postfix_client_hostname: 061238241086.static.ctinets.com
+    postfix_client_ip: 61.238.241.86
+    postfix_status_code: 550
+    postfix_status_code_enhanced: 5.12.345
+    postfix_status_data: [email protected]
+    postfix_status_message: "Recipient address rejected: Some error message"
+    postfix_keyvalue_data: from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<ecsolved.com>