Untitled

filter {

if [type] == "exim-log" {

  grok {
    overwrite => [ "message" ]
    match => { "message" => "%{DATESTAMP:timestamp} %{GREEDYDATA:message}" }
    add_tag => [ "_got_syslog_exim_timestamp" ]
  }

# Not everything has a MessageID but    if it has lets grab it here
  grok {
    overwrite => [ "message" ]
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{EXIM_MESSAGE_ID:message_id} %{GREEDYDATA:message}" }
    add_tag => [ "_got_syslog_exim_msg_id" ]
    remove_tag => "_grokparsefailure"
  }
 }
}