SpamTitan / Postfix extractors?

Graylog Central (peer support)
1

Just wondering if anyone has a decent set of Extractors they would be willing to share for Postfix and/or SpamTitan (which is postfix anyway).

Not really looking to match up whole email messages, i have seen those threads.
My main aim is to get the data indexed

I have spent most of the day trying to get something working from between

and

However at the end of the road, there was a lot of duplication that didn’t actually produce much of use (half extracts it / or matches on the wrong filter and fields end up with weird names)
I also found both took about 10 seconds per syslog message to process, so its not really viable :frowning:

Just thought i’d see if anyone shares a common headache before i start down the road of writing my own

Thanks!

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.