Count message for user

Hello everyone,
I was able to configure ELK cluster and grok for postfix, now I have a problem in finding information.
For every message sent I have 2 records similar to these:

  • postfix_queueid, postfix_from
  • postfix_queueid, postfix_to, postfix_queueid, postfix_status

How can I do to have a single line with:

postfix_queueid, postfix_from, postfix_to, postfix_status

Thank you

An aggregate filter might work. Can you give actual examples of the events?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.