I am currently sending my MTAs' /var/log/maillog files to a centralized Elastic Stack Log Analyser. I am using Elastic Stack version 7.X.
I have got a requirement to search set of message ids which look like message-id=<20210411134224.6E07810002DB5@mydomain against their delivery status.
This is happening if I take each message-id individually and get its Queue Id in that MTA and check the delivery status against that Queue Id. But this entire process requires 2 queries for each message id.
Is it possible to check the delivery status of the message ids in a given duration of time with one single compound query or any other means?
The requirement for the compound query is in Kibana Discovery, Visualization and Dashboards