filter f_syno_maillog {
	facility(mail)
	and message("^[{]\"id\":\"SYNOMailPlus-Server\"");
};

filter f_mail_info {
	match("mail" value("type"));
};

filter f_mail_security {
	not match("mail" value("type"));
	not match("admin_log" value("type"));
};

filter f_mailplus_server_admin_log {
    match("admin_log" value("type"));
};

parser p_json_message {
	json-parser(
		template("${MESSAGE}")
	);
};


destination d_mail_orig_forward {
	network(
		"127.0.0.1"
		port(9526)
		transport(tcp)
		ip-protocol(4)
		flush-lines(200)
		flush-timeout(10000)
		suppress(0)
	);
};

destination d_mail_info_forward {
	network(
		"127.0.0.1"
		port(9527)
		transport(tcp)
		ip-protocol(4)
		template("$(format-json --key MESSID --key QUEID --key SENDER --key RECEIVER HOST=${HOST} TIMESTAMP=int64(${TIMESTAMP}) SIZE=int64(${SIZE}) STATUS=int(${STATUS}) --key SUBJECT --key ORIMAILTO)\n")
		flush-lines(200)
		flush-timeout(10000)
		suppress(0)
	);
};

destination d_mail_security_forward {
	network(
		"127.0.0.1"
		port(9528)
		transport(tcp)
		ip-protocol(4)
		template("$(format-json --key type --key event --key sender --key recipient --key src HOST=${HOST} TIMESTAMP=int64(${UNIXTIME}) --key subject)\n")
		flush-lines(200)
		flush-timeout(10000)
		suppress(0)
	);
};

destination d_mail_adminlog_info_forward {
	network(
		"127.0.0.1"
		port(9529)
		transport(tcp)
		ip-protocol(4)
		template("$(format-json --key TAB_TYPE --key STATEMENT --key USER --key UID --key EXEC_TIME --key IP --key SERVER --key WEBAPI_PARAM HOST=${HOST})\n")
		flush-lines(200)
		flush-timeout(10000)
		suppress(0)
	);
};


log {
	source(src);
	filter(f_syno_maillog);
	parser(p_json_message);
	filter(f_mail_info);
	destination(d_mail_info_forward);
};

log {
	source(src);
	filter(f_syno_maillog);
	parser(p_json_message);
	filter(f_mail_security);
	destination(d_mail_security_forward);
};

log {
	source(src);
	filter(f_syno_maillog);
	parser(p_json_message);
	filter(f_mailplus_server_admin_log);
	destination(d_mail_adminlog_info_forward);
};

log {
	source(src);
	filter(f_mail);
	filter(f_mail_log);
	destination(d_mail_orig_forward);
};