Merge pull request #165 from whyscream/support-warn-if-reject

Add support for parsing the result of a warn_if_reject configuration.

Author: whyscream

postfix.grok

@@ -5,7 +5,7 @@ POSTFIX_QUEUEID ([0-9A-F]{6,}|[0-9a-zA-Z]{12,}|NOQUEUE)
 POSTFIX_CLIENT_INFO %{HOSTNAME:postfix_client_hostname}?\[%{IP:postfix_client_ip}\](:%{INT:postfix_client_port})?
 POSTFIX_RELAY_INFO %{HOSTNAME:postfix_relay_hostname}?\[(%{IP:postfix_relay_ip}|%{DATA:postfix_relay_service})\](:%{INT:postfix_relay_port})?|%{WORD:postfix_relay_service}
 POSTFIX_SMTP_STAGE (CONNECT|HELO|EHLO|STARTTLS|AUTH|MAIL( FROM)?|RCPT( TO)?|(end of )?DATA|RSET|UNKNOWN|END-OF-MESSAGE|VRFY|\.)
-POSTFIX_ACTION (accept|defer|discard|filter|header-redirect|reject)
+POSTFIX_ACTION (accept|defer|discard|filter|header-redirect|reject|reject_warning)
 POSTFIX_STATUS_CODE \d{3}
 POSTFIX_STATUS_CODE_ENHANCED \d\.\d+\.\d+
 POSTFIX_DNSBL_MESSAGE Service unavailable; .* \[%{GREEDYDATA:postfix_status_data}\] %{GREEDYDATA:postfix_status_message};

test/smtpd_0031.yaml

@@ -0,0 +1,13 @@
+pattern: ^%{POSTFIX_SMTPD}$
+data: "NOQUEUE: reject_warning: RCPT from example.com[93.184.216.34]: 553 5.7.1 <sender@example.com>: Sender address rejected: not owned by user ph123; from=<sender@example.com> to=<recipient@example.com> proto=ESMTP helo=<example.com>"
+results:
+    postfix_queueid: NOQUEUE
+    postfix_action: reject_warning
+    postfix_smtp_stage: RCPT
+    postfix_client_hostname: example.com
+    postfix_client_ip: 93.184.216.34
+    postfix_status_code: 553
+    postfix_status_code_enhanced: 5.7.1
+    postfix_status_data: sender@example.com
+    postfix_status_message: "Sender address rejected: not owned by user ph123"
+    postfix_keyvalue_data: from=<sender@example.com> to=<recipient@example.com> proto=ESMTP helo=<example.com>