Count message for user

Hello everyone,
I was able to configure ELK cluster and grok for postfix, now I have a problem in finding information.
For every message sent I have 2 records similar to these:

  • postfix_queueid, postfix_from
  • postfix_queueid, postfix_to, postfix_queueid, postfix_status

How can I do to have a single line with:

postfix_queueid, postfix_from, postfix_to, postfix_status

Thank you

An aggregate filter might work. Can you give actual examples of the events?