What does your current extraction look like in your props.conf file? Exactly what text in those events are you trying to assign a field to? Are you trying to create fields for sender, and subject? if so, then you would do something like this in your props.conf file:
[sourcetype_name] # this will be whatever sourcetype you have assigned to these events
EXTRACT-kv_event = \[mail\sbox\:\s(?[^\,]+)\,\ssender\:\s(?[^\,]+)\,\ssubject\:\s(?[^\<]+)\<
This would extract the fields mailbox,sender and subject out of your event.
Just a note, this site's formatting wrapped the code a little weird. The above is 2 lines of code, the first line ends with the comment and the 2nd line starts with the EXTRACT-kv_event string.
... View more