filter-50-dnsblog.conf

filter {
  if [postfix][component] == "dnsblog" {
    if [message] =~ /^addr/ {
      grok {
        match => ["message","addr %{IP:[client][address]} listed by domain %{HOSTNAME:[postfix][dnsbl][name]} as %{IP:[postfix][dnsbl][result]}"]
        id => "postfix_dnsbl"
        tag_on_failure => ["_grokparsefailure","postfix_dnsbl_failed"]
        add_field => {
          "[postfix][eventtype]" => "dnsbl"
        }
        add_tag => "grokked"
      }
    }
  }
}

# TODO
# warning: dnsblog_query: lookup error for DNS query 1.1.1.1.dnsbl.sorbs.net: Host or domain name not found. Name service error for name=1.1.1.1.dnsbl.sorbs.net type=A: Host not found, try again