I am pushing the /var/log/maillog to ELK Stack version 6.X
I was able to use the postfix grok filters available in github and create the indices, documents, fields and so and also I am able to see in Kibana too.
I am capturing the header message id in the /var/log/maillog which is being pushed to ELK.
I want to know through ELK searches that the message ids which got successfully sent, deferred and softbounce.
Here I faced the challenge of writing the query of search for the above requirement as the header message id is recorded in /var/log/maillog in one line while the delivery status would be recorded in a different line.
As per my understanding, each record or each line in the log file is called as a document in an Index. Correct me if I am wrong.
So, is there a way that would solve my requirement ? This has become a great challenge from past few days for me.