Daily Challenge: Postfix logging extractor

[dscryber (David Sciuto)]

@wbenkhoud

redirect syslog postfix log to graylog and I find difficulties to search for example a sent email from the beginning to the end as in every MTA gets new ID (I configure streams)

Welcome, Wafa, to the Graylog Community,

I’ve moved your question to Daily Challenges where it’s likely to get more expert eyes focused on it. While we await a response, check out this post, which may provide some guidance.

Analyzing Postfix / Amavis logfiles

Hey there, I’m very new to Graylog and now I’m stuck in analyzing my MX server. The MX is a CentOS 7 with a Postfix MTA with Postgrey greylisting and AMaVisD-New for spam and virus protection. Now I wanted to read the sender, the recipient and the sending SMTP server. But when I look in the logs there are more than one line I need to read and extract to get my information. I searched the marketplace and Google for a solution but I didn’t find anything. Has anyone a way to get the information I …