Thank you very much for the nice welcome to the community.
So with Filebeat I import the main.log (from exim) into ELA/Kibana.
This is what my filebeat.yml looks like
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
# Paths that should be crawled and fetched. Glob based paths.
In Kibana it looks like this
@timestamp:Aug 24, 2021 @ 10:01:00.011 agent.ephemeral_id:c0dff231-f7d3-4c54-b7f6-ed0642d02ccb
agent.hostname:centos7-ela agent.id:0313ca40-82cf-43f5-a30f-6462b81d1364 agent.name:centos7-ela
agent.type:filebeat agent.version:7.14.0 ecs.version:1.10.0 host.architecture:x86_64
host.containerized:false host.hostname:centos7-ela host.id:44a7caa7f42447a783293212cd5d080f
host.ip:xxx.xxx.xx.xxx, fe80::250:56ff:feb0:1b48 host.mac:00:50:56:b0:1b:48 host.name:centos7-ela
host.os.codename:Core host.os.family:redhat host.os.kernel:3.10.0-1160.36.2.el7.x86_64
host.os.name:CentOS Linux host.os.name.text:CentOS Linux host.os.platform:centos host.os.type:linux
host.os.version:7 (Core) input.type:log log.file.path:/var/log/exim/main.log log.offset:1,512,705
message:2021-08-22 10:02:10 1mHiQk-00087D-1A <= email@example.com-
All this is under the tab (column) document.
But I would like to build it in a way that I have a column where the recipient is in it, in this
example firstname.lastname@example.org, and I can search for it via the search field.
Example: if I search for email@example.com, I would like to see all entries that have firstname.lastname@example.org as recipient.
And I do not know how to do that ? Probably a template is missing here or something.
Can you help me there ? I have already looked at the following link https://graemef.wordpress.com/ but I do not get anywhere.