Ccver the scenario when [source][user][email] is empty

Co-authored-by: Thomas Widhalm <thomas.widhalm@netways.de>

Author: afeefghannam89

filter-50-qmgr.conf

@@ -21,7 +21,7 @@ filter {
     } else if [message] =~ /status=expired/ {
       # message exceeded maximal_queue_lifetime and is returned to sender
       grok {
-        match => ["message", "from=<%{DATA:[source][user][email]}>, status=expired, returned to sender"]
+        match => ["message", "from=<(%{DATA:[source][user][email]})?>, status=expired, returned to sender"]
         id => "postfix_qmgr_expired"
         tag_on_failure => ["_grokparsefailure", "postfix_qmgr_expired_failed"]
         add_field => {