diff --git a/51-filter-postfix-aggregate.conf b/51-filter-postfix-aggregate.conf deleted file mode 100644 index 0a6cd03..0000000 --- a/51-filter-postfix-aggregate.conf +++ /dev/null @@ -1,40 +0,0 @@ -filter { - if ![postfix_queueid] { - drop {} - } else if [postfix_queueid] == "NOQUEUE" { - drop {} - } else if [program] == "postfix/qmgr" and [postfix_from] { - aggregate { - task_id => "%{postfix_queueid}" - code => " - map['postfix_from'] = event.get('postfix_from') - map['postfix_size'] = event.get('postfix_size') - map['postfix_nrcpt'] = event.get('postfix_nrcpt') - " - } - } else if [program] == "postfix/smtpd" { - aggregate { - task_id => "%{postfix_queueid}" - code => " - map['postfix_client_hostname'] = event.get('postfix_client_hostname') - map['postfix_client_ip'] = event.get('postfix_client_ip') - " - } - } else if [program] == "postfix/cleanup" { - aggregate { - task_id => "%{postfix_queueid}" - code => " - map['postfix_message-id'] = event.get('postfix_message-id') - " - } - } else if [program] == "postfix/smtp" { - aggregate { - task_id => "%{postfix_queueid}" - code => " - map.each do |key, value| - event.set(key, value) - end - " - } - } -} diff --git a/README.md b/README.md index 717ec43..a4f3e9c 100644 --- a/README.md +++ b/README.md @@ -19,18 +19,6 @@ The included Logstash config file requires two input fields to exist in input ev This event format is supported by the Logstash `syslog` input plugin out of the box, but several other plugins produce input that can be adapted fairly easy to produce these fields too. See [ALTERNATIVE INPUTS](ALTERNATIVE-INPUTS.md) for details. -Aggregation filter ------ - -A optional aggregation filter is available, that will combine fields from different log lines. The key on which log lines are aggregated is the postfix queue id. For example: - -![Alt text](aggregation_example_pic.jpg?raw=true) - -In this example, the `postfix_from` field from a `postfix/qmgr` log line is reused, and added to a log line from `postfix/smtp`. - -To use the aggregation filter, add `51-filter-postfix-aggregate.conf` to `/etc/logstash/conf.d` or `pipeline` dir for dockerized Logstash. - - Tests ----- diff --git a/aggregation_example_pic.jpg b/aggregation_example_pic.jpg deleted file mode 100644 index c99db70..0000000 Binary files a/aggregation_example_pic.jpg and /dev/null differ