filter-50-smtps.conf

filter {
  if [postfix][component] == "smtps" {

    if [message] =~ /from/ {
      grok {
        match => ["message","%{DATA:[postfix][connection]} from %{HOSTNAME:[client][domain]}\[%{IP:[client][address]}\](: %{GREEDYDATA:[postfix][detail]})?"]
        id => "postfix_smtps_connect"
        tag_on_failure => ["_grokparsefailure","postfix_smtps_connect_failed"]
        add_field => {
          "[postfix][eventtype]" => "smtps_connect"
        }
        add_tag => "grokked"
      }

    } else if [message] =~ /^warning: .*authentication failed/ {
      grok {
        match => ["message","warning: %{HOSTNAME:[client][domain]}\[%{IP:[client][address]}\]: %{GREEDYDATA:[postfix][detail]}"]
        id => "postfix_smtps_authenticationfailed"
        tag_on_failure => ["_grokparsefailure","postfix_smtps_authenticationfailed"]
        add_field => {
          "[postfix][eventtype]" => "smtps_authenticationfailed"
        }
        add_tag => "grokked"
      }
    }
  }
}