dovecot.conf

input {
    pipeline {
        address => "dovecot-parsing-entry"
    }
}

filter {
    grok {
        patterns_dir    => "/etc/logstash/patterns.d"
        match           => [ "message", "^%{DOVECOT}$" ]
        tag_on_failure  => "_grok_dovecot_nomatch"
        add_tag         => "_grok_dovecot_success"
    }

    if [dovecot][keyvalue_data] {
        kv {
            source       => "[dovecot][keyvalue_data]"
            trim_value   => "<>,"
            target       => "dovecot_kv"
            remove_field => "[dovecot][keyvalue_data]"
        }

        mutate {
            # Due to the fact that we can't directly set target to dovecot (it overwrite previous keys)
            merge => { "dovecot" => "dovecot_kv" }
            remove_field => "dovecot_kv"
        }
    }

    mutate {
        convert => [
            # list of integer fields
            "[dovecot][in]", "integer",
            "[dovecot][out]", "integer",
            "[dovecot][deleted]", "integer",
            "[dovecot][expunged]", "integer",
            "[dovecot][trashed]", "integer",
            "[dovecot][hdr_count]", "integer",
            "[dovecot][hdr_bytes]", "integer",
            "[dovecot][body_count]", "integer",
            "[dovecot][body_bytes]", "integer",
            "[dovecot][mpid]", "integer"
        ]
    }
}

output {
	pipeline {
		send_to => "dovecot-parsing-exit"
	}
}