# Noob trying to process a file
**URL:** https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215
**Category:** Logstash
**Created:** [October 18, 2019, 11:18am UTC](https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215 "2019-10-18T11:18:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@tronty](https://discuss.elastic.co/u/tronty)
#### Post date: [October 18, 2019, 11:18am UTC](https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215/1 "2019-10-18T11:18:20Z")
Hi all,
So I'm trying to do something that I'm guessing is pretty basic but I am stuck and cannot find the answer.
Problems are with config file ☹
I've got an input file (postfix logs) that I want to parse with a grok (pattern).
Then parse with another grok filter which goes to grok patterns. (I'm a big noob and hope this horrible explanation makes sense. I think this is an input issue but I'm not sure.
I've tried a few variations but feel like I'm going in circles, is anyone able to point me in the right direction please.
input {
file {
path =\> "/home/user/Desktop/smtplogs/test2/\*"
file\_completed\_log\_path =\> "/home/user/Desktop/smtplogs/testlog"
mode =\> "read"
file\_completed\_action =\> "log"
filter {
if [message] =~ /^#/ {
drop { }
}
grok {
match =\> { "\A%{SYSLOGTIMESTAMP}%{SPACE}%{EMAILLOCALPART}%{SPACE}%{SYSLOGPROG}%{GREEDYDATA}" }
}
filter {
# grok log lines by program name (listed alpabetically)
if [program] =~ /^postfix.\*/anvil$/ {
grok {
patterns\_dir =\> "/etc/logstash/patterns.d"
match =\> ["message", "^%{POSTFIX\_ANVIL}"] tag\_on\_failure =\> ["\_grok\_postfix\_anvil\_nomatch"] add\_tag =\> ["\_grok\_postfix\_success"] } } else if [program] =~ /^postfix.\*\/bounce/ {
grok {
patterns\_dir =\> "/etc/logstash/patterns.d"
match =\> ["message", "^%{POSTFIX\_BOUNCE}$"]
tag\_on\_failure =\> ["\_grok\_postfix\_bounce\_nomatch"]
add\_tag =\> ["\_grok\_postfix\_success"]
}
more of the above
mutate {
convert =\> [
# list of integer fields
"postfix\_anvil\_cache\_size", "integer",
"postfix\_anvil\_conn\_count", "integer",
"postfix\_anvil\_conn\_rate", "integer",
"postfix\_client\_port", "integer",
"postfix\_cmd\_auth", "integer",
"postfix\_cmd\_auth\_accepted", "integer",
"postfix\_cmd\_count", "integer",
"postfix\_cmd\_count\_accepted", "integer",
"postfix\_cmd\_data", "integer",
"postfix\_cmd\_data\_accepted", "integer",
"postfix\_cmd\_ehlo", "integer",
"postfix\_cmd\_ehlo\_accepted", "integer",
"postfix\_cmd\_helo", "integer",
"postfix\_cmd\_helo\_accepted", "integer",
"postfix\_cmd\_mail", "integer",
"postfix\_cmd\_mail\_accepted", "integer",
"postfix\_cmd\_quit", "integer",
"postfix\_cmd\_quit\_accepted", "integer",
"postfix\_cmd\_rcpt", "integer",
"postfix\_cmd\_rcpt\_accepted", "integer",
"postfix\_cmd\_rset", "integer",
"postfix\_cmd\_rset\_accepted", "integer",
"postfix\_cmd\_starttls", "integer",
"postfix\_cmd\_starttls\_accepted", "integer",
"postfix\_cmd\_unknown", "integer",
"postfix\_cmd\_unknown\_accepted", "integer",
"postfix\_nrcpt", "integer",
"postfix\_postscreen\_cache\_dropped", "integer",
"postfix\_postscreen\_cache\_retained", "integer",
"postfix\_postscreen\_dnsbl\_rank", "integer",
"postfix\_relay\_port", "integer",
"postfix\_server\_port", "integer",
"postfix\_size", "integer",
"postfix\_status\_code", "integer",
"postfix\_termination\_signal", "integer",
```
# list of float fields
"postfix_delay", "float",
"postfix_delay_before_qmgr", "float",
"postfix_delay_conn_setup", "float",
"postfix_delay_in_qmgr", "float",
"postfix_delay_transmission", "float",
"postfix_postscreen_violation_time", "float"
]
}
```
}
}
output {
stdout { codec =\> rubydebug }
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 18, 2019, 2:49pm UTC](https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215/2 "2019-10-18T14:49:36Z")
And what is the problem? Are you getting an error message?
---
### Author:  [@tronty](https://discuss.elastic.co/u/tronty)
#### Post date: [October 25, 2019, 8:56am UTC](https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215/3 "2019-10-25T08:56:32Z")
Hi Badger,
Sorry I've only just seen this message for some reason... Thank you for responding.
Yes, It's failing to start - I tried multiple variants - I was hoping someone who had potentially parsed postfix logs before might chime in with what their config was.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2019, 8:56am UTC](https://discuss.elastic.co/t/noob-trying-to-process-a-file/204215/4 "2019-11-22T08:56:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.