# Proofpoint sendmail/ syslog

**URL:** <https://discuss.elastic.co/t/proofpoint-sendmail-syslog/231522>\
**Category:** Logstash\
**Created:** [May 7, 2020, 11:38am UTC](https://discuss.elastic.co/t/proofpoint-sendmail-syslog/231522 "2020-05-07T11:38:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesy281](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@jamesy281](https://discuss.elastic.co/u/jamesy281)\
**Post date:** [May 7, 2020, 11:38am UTC](https://discuss.elastic.co/t/proofpoint-sendmail-syslog/231522/1 "2020-05-07T11:38:29Z")

</div>

Hey there,

I am currently ingesting Proofpoint mail/ filter/ security, etc logs into our Rapid7 SIEM. I found though that I am unable to do a simple log search for say messages from & to a user as proofpoint/ sendmail breaks the whole process into individual lines. I was planning on using logstash to ingest these, grok them and then export as json. I wanted to check that this is possible with logstash. Is there a grok template availble for proofpoint logs so that I can ingest and group the messages together by SMTP ID and what is the best method to output these as JSON so that I can then ingest them into R7?  
I will set up a test config and try ths out but any insight you guy can provide would be really helpful.

Cheers,  
Jamesy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2020, 11:38am UTC](https://discuss.elastic.co/t/proofpoint-sendmail-syslog/231522/2 "2020-06-04T11:38:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.