[PARSER]
    name postfix_smtpd_connect
    format regex
    regex (?<act>connect) from (?<hostname>[^\[]+)\[(?<ip>[^\]]+)\]

[PARSER]
    name postfix_smtpd_disconnect
    format regex
    regex (?<act>disconnect) from (?<hostname>[^\[]+)\[(?<ip>[^\]]+)\]( ehlo=(?<ehlo>\d+))?( mail=(?<mail>\d+))?( rcpt=(?<rcpt>\d+))?( data=(?<data>\d+))?( quit=(?<quit>\d+))?( commands=(?<commands>\d+))?
    types ehlo:integer mail:integer rcpt:integer data:integer quit:integer commands:integer

[PARSER]
    name postfix_smtpd_lost
    format regex
    regex (?<act>lost) connection after EHLO from (?<hostname>[^\[]+)\[(?<ip>[^\]]+)\]

[PARSER]
    name postfix_smtpd_message
    format regex
    regex (?<qid>[^:]+): client=(?<hostname>[^\[]+)\[(?<ip>[^\]]+)\]

[PARSER]
    name postfix_cleanup_message_id
    format regex
    regex (?<qid>[^:]+): (?<act>message-id)=<(?<mid>[^>]*)>

[PARSER]
    name postfix_qmgr_removed
    format regex
    regex (?<qid>[^:]+): (?<act>removed)

[PARSER]
    name postfix_qmgr_enqueue
    format regex
    regex (?<qid>[^:]+): from=<(?<from>[^>]*)>, size=(?<size>\d+), nrcpt=(?<nrcpt>\d+) \((?<queue>[^\)]+)\)
    types size:integer nrcpt:integer

[PARSER]
    name postfix_qmgr_expired
    format regex
    regex (?<qid>[^:]+): from=<(?<from>[^>]*)>, status=(?<status>[^,]+), (?<msg>.+)

[PARSER]
    name postfix_smtp_send
    format regex
    regex (?<qid>[^:]+): to=<(?<to>[^>]+)>, relay=(?<relay>(none|[^\[]+))(\[(?<ip>[^\]]+)\]:(?<port>\d+))?, delay=(?<delay>[^,]+), delays=(?<receive>[^\/]+)\/(?<queue>[^\/]+)\/(?<conn>[^\/]+)\/(?<send>[^,]+), dsn=(?<dsn>[^,]+), status=(?<status>[^ ]+) \((?<msg>[^\)]+)\)

[PARSER]
    name postfix_smtp_send_error
    format regex
    regex (?<qid>[^:]+): host (?<host>[^\[]+)\[(?<ip>[^\]]+)\] (said|refused to talk to me): (?<msg>.+)

[PARSER]
    name postfix_smtp_connect_error
    format regex
    regex connect to (?<host>[^\[]+)\[(?<ip>[^\]]+)\]:(?<port>\d+): (?<msg>.+)

[PARSER]
    name postfix_discard_error
    format regex
    regex (?<lvl>warning): (?<msg>.+)

[PARSER]
    name postfix_bounce_notification
    format regex
    regex (?<qid>[^:]+): (?<reason>sender non-delivery notification): (?<mid>.+)