From 2ed4c40a0cf43616e1d9c3d6aaa8b840e02f83aa Mon Sep 17 00:00:00 2001 From: Tom Hendrikx Date: Fri, 2 Feb 2024 23:10:22 +0100 Subject: [PATCH] Ignore but not drop NOQUEUE events while aggregating --- 51-filter-postfix-aggregate.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/51-filter-postfix-aggregate.conf b/51-filter-postfix-aggregate.conf index 0a6cd03..3b2492e 100644 --- a/51-filter-postfix-aggregate.conf +++ b/51-filter-postfix-aggregate.conf @@ -2,7 +2,9 @@ filter { if ![postfix_queueid] { drop {} } else if [postfix_queueid] == "NOQUEUE" { - drop {} + # Ignore events where the queueid is NOQUEUE, they can't be aggregated. + # The empty mutate filter serves as a 'noop', + mutate {} } else if [program] == "postfix/qmgr" and [postfix_from] { aggregate { task_id => "%{postfix_queueid}"