Initially in response to My Elastic Stack Observability Wishlist - #5 by weltenwort, but I think this really is it's own topic.
Are there ECS fields for Postfix logs? Or, rather, how would you break out postfix log messages into ECS fields?
I'm looking through the docs. But I'd love it if someone would share their prior experience.
Let's describe what kind of info I'm actually trying to get.
I'd like to use the queueid to detect how many individual emails are being processed. You get 5+ log entries per message, depending on how long it takes the message to get out of the queue.
I'd like to use the from= and to= fields to detect if a specific address is sending, or receiving more, or less, emails than usual.
I'd like to watch for entries with errors like "Network is unreachable".
I have a feeling that the data in the
delays= fields could be useful. But I need research what they actually mean first... :\