Logs of the Postfix mail server have records written as events occur, sequentially in time. This causes lines multiple messages to have their events interleaved rather than threaded together such as this example with three messages:
Jul 15 10:05:21 testhost postfix/smtpd[12281]: connect from sender1[]
Jul 15 10:05:23 testhost postfix/smtpd[12282]: connect from sender2[]
Jul 15 10:05:25 testhost postfix/smtpd[12283]: connect from sender3[]

Jul 15 10:05:26 testhost postfix/smtpd[12283]: B29E423803C: client=sender3[]
Jul 15 10:05:27 testhost postfix/cleanup[12883]: B29E423803C: message-id=<>
Jul 15 10:05:28 testhost postfix/qmgr[19613]: B29E423803C: from=<>
Jul 15 10:05:29 testhost postfix/smtpd[12283]: disconnect from sender3[]
Jul 15 10:05:30 testhost postfix/local[12983]: B29E423803C: to=<>, status=sent
Jul 15 10:05:31 testhost postfix/qmgr[19613]: B29E423803C: removed

Jul 15 10:05:32 testhost postfix/smtpd[12282]: B29E423803B: client=sender2[]
Jul 15 10:05:33 testhost postfix/cleanup[12882]: B29E423803B: message-id=<>
Jul 15 10:05:34 testhost postfix/qmgr[19612]: B29E423803B: from=<>
Jul 15 10:05:35 testhost postfix/smtpd[12282]: disconnect from sender2[]
Jul 15 10:05:36 testhost postfix/local[12982]: B29E423803B: to=<>, status=sent
Jul 15 10:05:37 testhost postfix/qmgr[19612]: B29E423803B: removed

Jul 15 10:05:38 testhost postfix/smtpd[12281]: B29E423803A: client=sender1[]
Jul 15 10:05:39 testhost postfix/cleanup[12881]: B29E423803A: message-id=<>
Jul 15 10:05:40 testhost postfix/qmgr[19611]: B29E423803A: from=<>
Jul 15 10:05:41 testhost postfix/smtpd[12281]: disconnect from sender1[]
Jul 15 10:05:42 testhost postfix/local[12981]: B29E423803A: to=<>, status=sent
Jul 15 10:05:43 testhost postfix/qmgr[19611]: B29E423803A: removed
pflogthreader --wrap < maillog will thread the events for each message based on the process id and queue id resulting in this output sequentially via "connect" time:
Jul 15 10:05:21 from sender1[]
   +17s queued as B29E423803A
   +20s disconnect
   +21s status=sent
Jul 15 10:05:23 from sender2[]
   +9s queued as B29E423803B
   +12s disconnect
   +13s status=sent
Jul 15 10:05:25 from sender3[]
   +1s queued as B29E423803C
   +4s disconnect
   +5s status=sent
Without the use of the "--wrap" option each thread is output as a single line, allowing for filtering via grep, etc. but needing to turn the tab delimiters back to line feeds: pflogthreader < maillog | grep sender3 | tr '\t' '\n' | cut -c1-50
Jul 15 10:05:25 from sender3[]
   +1s queued as B29E423803C
   +4s disconnect
   +5s status=se
Get the code at