Actually, this has made me think now I understand what is going on.

Postfix logs the mavericks between [] brackets. The first set of [] brackets are the session ID. There is only the session ID [] brackets and the maverick's [] brackets on the matches I need to check.

So all I need to do for ALL the matches is:

$line =~ /.*[//; gobble all up to the last [
$line =~ /].*//;  get rid of the rest after ]
[download]

Thanks!

Nick