title: logstash parse log field
body: <p>I am trying to parse the <code>@message</code> field from a Postfix log and extract it into multiple fields.</p>
  
  <p><strong>Message:</strong></p>
  
  <pre><code>&lt;22&gt;Sep 17 19:12:14 postfix/smtp[18852]: 28D40A036B: to=&lt;test@gmail.com&gt;, relay=192.244.100.25[192.244.100.25]:25, delay=0.13, delays=0.01/0.01/0.09/0.02, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 9030A15D0)
  </code></pre>
  
  <p><strong>LogStash Output:</strong></p>
  
  <pre><code>{
    "@source": "syslog://192.244.100.42/",
    "@tags": [
      "_grokparsefailure"
    ],
    "@fields": {
      "priority": 13,
      "severity": 5,
      "facility": 1,
      "facility_label": "user-level",
      "severity_label": "Notice"
    },
    "@timestamp": "2013-09-17T17:12:06.958Z",
    "@source_host": "192.244.100.42",
    "@source_path": "/",
    "@message": "&lt;22&gt;Sep 17 19:12:14 postfix/smtp[18852]: 28D40A036B: to=&lt;test@gmail.com&gt;, relay=192.244.100.25[192.244.100.25]:25, delay=0.13, delays=0.01/0.01/0.09/0.02, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 9030A15D0)",
    "@type": "syslog"
  }
  </code></pre>
  
  <p>I've tried to use the grok parser but the data remains in the <code>@message</code> field. I want to use syslog parser with regular expressions.</p>
  
  <p>What steps do I follow to parse the <code>@message</code> field?</p>