{"action":"created","issue":{"url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/68","labels_url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/68/labels{/name}","comments_url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/68/comments","events_url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/68/events","html_url":"https://github.com/whyscream/postfix-grok-patterns/issues/68","id":112540003,"number":68,"title":"The way to match","user":{"login":"bachkhoabk47","id":5723383,"avatar_url":"https://avatars.githubusercontent.com/u/5723383?v=3","gravatar_id":"","url":"https://api.github.com/users/bachkhoabk47","html_url":"https://github.com/bachkhoabk47","followers_url":"https://api.github.com/users/bachkhoabk47/followers","following_url":"https://api.github.com/users/bachkhoabk47/following{/other_user}","gists_url":"https://api.github.com/users/bachkhoabk47/gists{/gist_id}","starred_url":"https://api.github.com/users/bachkhoabk47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bachkhoabk47/subscriptions","organizations_url":"https://api.github.com/users/bachkhoabk47/orgs","repos_url":"https://api.github.com/users/bachkhoabk47/repos","events_url":"https://api.github.com/users/bachkhoabk47/events{/privacy}","received_events_url":"https://api.github.com/users/bachkhoabk47/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-10-21T08:50:11Z","updated_at":"2015-10-29T07:26:23Z","closed_at":"2015-10-21T09:03:16Z","body":"Dear authors.\r\nLike issue #66:\r\nI have some confusions that I saw in 50-filter-postfix.conf and postfix.grok\r\nFirst, I push my log up. For example, like this:\r\nSep 30 00:00:02 SendingGW2 postfix/pickup[14400]: 321511FE45: uid=0 from=<root>\r\n\r\nand then the log will be mapped in [program] =~ /^postfix.*\\/pickup$/ field.\r\n--> after that it will go to /etc/logstash/patterns.d directory for processing.\r\nand the log will find POSTFIX_PICKUP in /etc/logstash/patterns.d for matching.\r\nPOSTFIX_PICKUP %{POSTFIX_KEYVALUE}\r\n--> POSTFIX_KEYVALUE %{POSTFIX_QUEUEID:postfix_queueid}: %{GREEDYDATA:postfix_keyvalue_data}\r\n\r\nWith my log matching, I just see: postfix_queueid=321511FE45\r\nbut be confused about \"uid=0 from=<root>\" matching to %{GREEDYDATA:postfix_keyvalue_data}\r\n\r\nShould I need to change your configuration or not? and how can I edit your file to matching my log.\r\nThanks and best regards.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/comments/152101712","html_url":"https://github.com/whyscream/postfix-grok-patterns/issues/68#issuecomment-152101712","issue_url":"https://api.github.com/repos/whyscream/postfix-grok-patterns/issues/68","id":152101712,"user":{"login":"bachkhoabk47","id":5723383,"avatar_url":"https://avatars.githubusercontent.com/u/5723383?v=3","gravatar_id":"","url":"https://api.github.com/users/bachkhoabk47","html_url":"https://github.com/bachkhoabk47","followers_url":"https://api.github.com/users/bachkhoabk47/followers","following_url":"https://api.github.com/users/bachkhoabk47/following{/other_user}","gists_url":"https://api.github.com/users/bachkhoabk47/gists{/gist_id}","starred_url":"https://api.github.com/users/bachkhoabk47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bachkhoabk47/subscriptions","organizations_url":"https://api.github.com/users/bachkhoabk47/orgs","repos_url":"https://api.github.com/users/bachkhoabk47/repos","events_url":"https://api.github.com/users/bachkhoabk47/events{/privacy}","received_events_url":"https://api.github.com/users/bachkhoabk47/received_events","type":"User","site_admin":false},"created_at":"2015-10-29T07:26:23Z","updated_at":"2015-10-29T07:26:23Z","body":"program? in  \"if [program] = .....\"\r\nSee here to understand https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/syslog-ng-patterndb-operation.html\r\nThanks author!"}}