Shipping Postfix logs to ELK stack


Well this is not actually an issue rather query. I have been playing with ELK stack for a few days. I have a working ELK stack running on Ubuntu 16.04. Kibana has Marvel and Sense installed and working. I can ship Beats, Syslog, Apache logs and Windows events (via Winlogbeat) to my ELK stack. So far, so good. Now, I want to ship mail logs (postfix logs) to my ELK stack. Is there any way to do that?

ELK server: Ubuntu 16.04
Elasticsearch: 2.5
Logstash: 2.5
Kibana: 4.5

Best regards,

Take a look at this article and see if that help you get started.

The grok filter patterns will be a useful starting point.

Hi Tinle,

Thanks for your reply. I was actually following this article. Not working for me. Don't know why. I don't know how to use grokdebug. And I also don't know how to write grok file :frowning:

This is more of a logstash question than ES. You will need to adapt the grok patterns I used to your postfix log format. For more information about what grok patterns and filters are, start here:

If you run into problems, please post more details. Such as what did you tried, what did not work, errors that you got, etc. The more details the better to give us context and better able to help you.