Email attachements

i use elasticSearch 6.2 i want transfer my database(emails) from my gmail to elasticsearch
the probleme is that elastcisearch can't read the emails which contains attachements like PDF , XML files
i found that i need install : ingest plugin attachement
i have installed it
and when i start logstash i got this error :
[2018-05-15T12:31:25,411][ERROR][logstash.pipeline ] A plugin had an unrecoverable error. Will restart this plugin.
Pipeline_id:main
Plugin: <LogStash::Inputs::IMAP host=>"imap.gmail.com", password=>, user=>"rouchad767@gmail.com", port=>993, secure=>true, fetch_count=>15, check_interval=>10, folder=>"Inbox", id=>"5b54a6cc24ec8207c02a599c52899e0822d819c18ab6fea278f09e1ea2a56e8b", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_7ddc0b5d-4cbd-4467-9945-c7e6005478ac", enable_metric=>true, charset=>"UTF-8">, verify_cert=>true, lowercase_headers=>true, delete=>false, expunge=>false, strip_attachments=>false, content_type=>"text/plain">
Error: Can not decode an entire message, try calling #decoded on the various fields and body or parts if it is a multipart message.
Exception: NoMethodError
Stack: C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/mail-2.6.6/lib/mail/message.rb:1903:in decoded' C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:119:inparse_mail'
C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:88:in block in check_mail' org/jruby/RubyArray.java:1734:ineach'
C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:82:in block in check_mail' org/jruby/RubyArray.java:1778:ineach_slice'
C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:80:in check_mail' C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:69:inblock in run'
C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:20:in interval' C:/elk/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-imap-3.0.6/lib/logstash/inputs/imap.rb:68:inrun'
C:/elk/logstash/logstash-core/lib/logstash/pipeline.rb:516:in inputworker' C:/elk/logstash/logstash-core/lib/logstash/pipeline.rb:509:inblock in start_input'

please i need your help
thanks

As the error is a Logstash one I moved your question to #logstash forum.

1 Like

thank you Dadoonet

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.