# Ingest postfix (mail) logs to ELK
**URL:** https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663
**Category:** Elasticsearch
**Created:** [March 14, 2022, 8:08pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663 "2022-03-14T20:08:32Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Guif](https://discuss.elastic.co/u/Guif)
#### Post date: [March 14, 2022, 8:08pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/1 "2022-03-14T20:08:32Z")
Hi!
I would like to ingest sendmail logs (/var/log/maillog) from different servers (about 5) into Elasticsearch at the same time.
I did Google search and found different and confused tutorials about this.
Anybody can help to define what product is more recomendated to do this? (filebeat or logstash)
I only need to read and ingest the information from log called /var/log/maillog every 1 minute or realtime if it's possible
Thanks in advance
---
### Author:  [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)
#### Post date: [March 14, 2022, 8:21pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/2 "2022-03-14T20:21:06Z")
Both (logstash and filebeat) is fine.
However, for simple file reads from servers and ingesting them into elastic. I would recommend (and to my knowledge is generally recommended) to use filtebeat. This because filebeat is generally less resource intensive on your system.
---
### Author:  [@Guif](https://discuss.elastic.co/u/Guif)
#### Post date: [March 14, 2022, 8:38pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/3 "2022-03-14T20:38:31Z")
> [@sholzhauer](#):
>
> However, for simple file reads from servers and ingesting them into elastic. I would recommend (and to my knowledge is generally recommended) to use filtebeat. This because filebeat is generally less resource intensive on your system.
Ok. Assuming I can use FileBeat to read and parse the log too before the ingest to the ELK server? In this situation I only need to install FileBeat and perform the configuration on all different servers. This is right?
---
### Author:  [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)
#### Post date: [March 15, 2022, 8:38am UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/4 "2022-03-15T08:38:36Z")
Yes, you can create one config and add this to all your servers (assuming they are the same).
The parsing of the events will take place in Elasticsearch using an ingest pipeline which you will have to create
---
### Author:  [@Guif](https://discuss.elastic.co/u/Guif)
#### Post date: [March 16, 2022, 2:49pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/5 "2022-03-16T14:49:48Z")
it's possible to parse the log of maillog? There's any module or an oficial yml? I didn't found...
---
### Author:  [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)
#### Post date: [March 18, 2022, 8:14am UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/6 "2022-03-18T08:14:13Z")
There isn't an out of the box one provided to my knowledge. Howeverr you can create your own.
---
### Author:  [@Guif](https://discuss.elastic.co/u/Guif)
#### Post date: [March 22, 2022, 6:57pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/7 "2022-03-22T18:57:10Z")
With filtebeat is it possible? How can I split all fields from logs?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2022, 6:57pm UTC](https://discuss.elastic.co/t/ingest-postfix-mail-logs-to-elk/299663/8 "2022-04-19T18:57:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.