30-rspamd.conf

filter {

  if [fields][beats_output] == "rspamd" {

    grok {
      patterns_dir  => "/etc/logstash/patterns.d"
      match         => { "message" => "%{RSPAMD}" }
      overwrite     => ["message"]
    }
    if [rspamd][module] =~ /^milter$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{RSPAMD_MILTER}$" ]
            tag_on_failure => [ "_grok_rspamd_milter_nomatch" ]
            add_tag        => [ "_grok_rspamd_success" ]
        }
    }
    date {
      match           => [ "[rspamd][timestamp]", "yyyy-MM-dd HH:mm:ss" ]
      timezone        => "Europe/Berlin"
      locale          => "de"
      target          => "timestamp"
      remove_field    => ["[rspamd][timestamp]"]
    }

    if [rspamd][milter][ip] {
        geoip {
            source => "[rspamd][milter][ip]"
            target => "[rspamd][milter][geoip]"
        }

        mutate {
            add_field => {"[rspamd][milter][hostname]" => "%{[rspamd][milter][ip]}"}
        }
        dns {
            reverse => [ "[rspamd][milter][hostname]" ]
            action => "replace"
            hit_cache_size => 8000
            hit_cache_ttl => 300
            failed_cache_size => 1000
            failed_cache_ttl => 300
        }
    }

  }
}