td-agent.conf

# postfix
<source>
  @type tail
  format /(?<time>[\w]+\s+[\d]+\s[\d:]+)\s+(?<data>.+)/
  time_format %b %d %H:%M:%S

  path /var/log/mail.log
  pos_file /var/log/td-agent/postfix_pos.log
  tag raw.postfix.result
</source>

<match raw.postfix.result>
  @type copy
  <store>
    @type parser
    remove_prefix raw
    format /(?<host>[\w\d-]+)\s*(?<process>[\w\/]+)\[(?<pid>[\d]+)\]\:\s*(?<queue_id>[\w]{10}):\sfrom=<(?<from_address>[^,]+)>,\s*size=(?<size>[^,]+),\s*nrcpt=(?<nrcpt>[\w]+)\s*\((?<message>(.*))\)/
    key_name data
  </store>

  <store>
    @type parser
    remove_prefix raw
    format /(?<host>[\w-]+)\s*(?<process>[\w\/]+)\[(?<pid>[\d]+)\]\:\s*(?<queue_id>[\w]{10}):\s*to=<(?<to_address>[^,]+)>,\s*relay=(?<relay>[^,]+),\s*delay=(?<delay>[^,]+),\s*delays=(?<delays>[^,]+),\s*dsn=(?<dns>[^,]+),\s*status=(?<status>[\w]+)\s*\((?<message>(.*))\)/
    key_name data
  </store>
</match>



<match postfix.result>

  # use buffer for lot's of logs
  buffer_type file
  buffer_path /var/log/td-agent/buffer
  buffer_chunk_limit 1G
  buffer_queue_limit 10000
  flush_interval 60s
  disable_retry_limit false
  retry_limit 10
  retry_wait 1s
  max_retry_wait 10

  # write to another file
  @type exec
  command python /root/workspace/runner.py
  format json
  tag_key logtype
  time_key timestamp
  time_format %s

  # write log here when first store fails
  <secondary>
      @type file
      path /var/log/td-agent/forward-failed
      format json
      include_time_key true
      time_key timestamp
      time_format %s
  </secondary>

</match>