# Postfix grok patterns not working
**URL:** https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741
**Category:** Logstash
**Created:** [June 23, 2016, 6:48am UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741 "2016-06-23T06:48:16Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@raamee](https://discuss.elastic.co/u/raamee)
#### Post date: [June 23, 2016, 6:48am UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741/1 "2016-06-23T06:48:16Z")
Hello,
I'm trying to filter postfix logs using the grok patterns posted here: [https://github.com/whyscream/postfix-grok-patterns](https://github.com/whyscream/postfix-grok-patterns)
The thing is, its not filtering the postfix logs properly. It is not segregating the message field which contains various fields like FROM, TO , HOST, STATUS, NCRPT , etc.
I'm still using logstash and elastic search, kibana are all latest stable release.
Can any one help?
---
### Author:  [@yodog](https://discuss.elastic.co/u/yodog)
#### Post date: [June 23, 2016, 7:10pm UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741/2 "2016-06-23T19:10:27Z")
Sure.
Have you tried testing you parser rules here? [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)
I created my own patterns for Cyrus, and tested all of them there.
---
### Author:  [@raamee](https://discuss.elastic.co/u/raamee)
#### Post date: [June 24, 2016, 4:26am UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741/3 "2016-06-24T04:26:32Z")
No, but its a general postfix log. There are 100's of lines to be tested with grokdebug parser which I feel extremely difficult.
---
### Author:  [@yodog](https://discuss.elastic.co/u/yodog)
#### Post date: [June 24, 2016, 12:49pm UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741/4 "2016-06-24T12:49:09Z")
you dont have to test them all.
just the lines that parses the fields FROM, TO , HOST, STATUS, NCRPT, like you said.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741/5 "2017-07-06T04:50:53Z")