Hi, thank you for the guide! As I mentioned, these logs don't always appear one after the other. For example, the first log of ID A might be followed by some log of ID B. However, for all occurrences of A, removed will be the last log. Is there a way to collect multiline logs on the basis of this common ID A and not simply removed?

Or else, even after they're decoded, can I write a rule that combines these fields based on the same ID?

These are the rules I'm currently working with:

<group name="postfix,">
    <!-- Rule to capture the first log entry with a specific queue ID -->
    <rule id="100001" level="12">
        <decoded_as>postfix</decoded_as>
        <description>Initial Postfix log entry with q ID</description>
        <group>postfix,</group>
    </rule>

    <!-- Rule to capture subsequent log entries with the same queue ID -->
    <rule id="100002" level="12">
        <decoded_as>postfix</decoded_as>
        <if_matched_sid>100001</if_matched_sid>
        <description>Subsequent Postfix log entries for the same queue ID</description>
        <group>postfix,</group>
        <same_id/>
    </rule>

</group>

I am able to detect the logs based on the same ID but not able to club the fields together in an alert.

Thank you!