Try to Parsing Postfix Log Using Logstash

It is not a drop-in addition to your existing configuration, not is it a complete configuration by itself. You may not need anything from it except some ideas from the aggregate, and that will need to be updated to adjust field names.

As I said, it is just an outline of an approach.