ACZoom

    "Postfix-550": r"""^[^[]+?postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from .*?\[(::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\]: 550 5.1.1 : Recipient address rejected: User unknown in virtual alias table;"""

The extra checks for first [ after smptd, and the full text after 550 5.1.1 is useful to help avoid false positives by hackers injecting false lines in the log files. But of course, if postfix program changes that text, then the rule above will need to be updated.