# Grouping postfix queueid **URL:** \ **Category:** Kibana\ **Created:** [January 28, 2017, 6:20pm UTC](https://discuss.elastic.co/t/grouping-postfix-queueid/73096 "2017-01-28T18:20:37Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![toger](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@toger](https://discuss.elastic.co/u/toger)\ **Post date:** [January 28, 2017, 6:20pm UTC](https://discuss.elastic.co/t/grouping-postfix-queueid/73096/1 "2017-01-28T18:20:37Z")
My system is logging postfix logs (via Filebeat -\> Logstash -\> ElasticSearch 5.X) I configured postfix patterns in logstash, so every fields are usable and searchable in kibana. My logs file looks like below : line 1 : Jun 25 09:20:29 server postfix/smtpd[18999]: D920718033: client=test.local[10.3.45.20] line 2 : Jun 25 09:20:29 server postfix/cleanup[19004]: D920718033: [message-id=558BABBD.7010601@yyy.fr](mailto:message-id=558BABBD.7010601@yyy.fr) line 3 : Jun 25 09:20:29 server postfix/qmgr[3759]: D920718033: [from=xxx@yyy.fr](mailto:from=xxx@yyy.fr), size=28828, nrcpt=1 (queue active) line 4 : Jun 25 09:20:30 server postfix/pipe[19005]: D920718033: [to=xxx@yyy.fr](mailto:to=xxx@yyy.fr) [relay=yyy.fr](http://relay=yyy.fr), delay=0.13, delays=0.07/0.01/0/0.06, dsn=2.0.0, status=sent (delivered via [yyy.fr](http://yyy.fr) service) line 5 : Jun 25 09:20:30 server postfix/qmgr[3759]: D920718033: removed As we cannot have multiline input in filebeat for this kind of postfix logs, i would like to group them by the unique postfix\_queueid for example, that is present on each line of the smtp transaction. How can we achieve this ? with elasticsearch aggregation ? I would like for example to search every postfix\_status=sent (matching only the line 4) and retrieve automatically its postfix\_queueid (ie : D920718033), to display all the logs lines containing this queueid Is is possible to get this search in 1 step ? Or get a visualization or graph (via x-pack) to 1. search for a specific status (sent, bounce.. whatever) 2. show all entrys with the qid of thoses lines 3. built the matching graphs with the input of the qid entrys Thanks in advance for your support. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 29, 2017, 4:07am UTC](https://discuss.elastic.co/t/grouping-postfix-queueid/73096/2 "2017-01-29T04:07:15Z")
If all the events flow through one processing pipeline, you can use an aggregation filter in LS. Otherwise you could use Graph to link them once in ES. ---
**Author:** ![toger](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@toger](https://discuss.elastic.co/u/toger)\ **Post date:** [January 29, 2017, 11:09am UTC](https://discuss.elastic.co/t/grouping-postfix-queueid/73096/3 "2017-01-29T11:09:21Z")
Yes all events comes through logstash. Sources comes from several filebeat instances with each one their own index. I have found this aggregation filter that could suit my needs : [https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf](https://github.com/topmedia/logstash-postfix/blob/master/etc/logstash/conf.d/51-filter-postfix-aggregate.conf) I think i will try to use Graph also to see how correlation between queueids will be displayed, and perhaps the event aggregation groupby queueid won't be necessary. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 26, 2017, 11:09am UTC](https://discuss.elastic.co/t/grouping-postfix-queueid/73096/4 "2017-02-26T11:09:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.