# Email formatting for ES with logstash pipline?

**URL:** <https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585>\
**Category:** Logstash\
**Created:** [November 6, 2018, 5:41pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585 "2018-11-06T17:41:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jackson\_Pollock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackson_pollock/32/37068_2.png) [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\
**Post date:** [November 6, 2018, 5:41pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585/1 "2018-11-06T17:41:47Z")

</div>

Using the imap plugin and am seeing email come across in a variety of formats, sometimes txt, html, or base64 encoded like:

--_000\_9DC799C9E1E4436E8FDA8B3339216EB3forescoutcom_  
Content-Type: text/plain;  
charset=utf-8  
Content-Transfer-Encoding: base64

SSBqdXN0IGRpZCBhIGN1dCBhbmQgcGFzdGUuICBJdCB3b3JrZWQgZmluZSBm  
b3IgbWUuDQoNCmo5SjAjaX5WOA0KDQoNCg0KDQoNClRoYW5rcywNCg0KVGVk  
DQoNCg0KDQpUZWQgU2xvY2tib3dlciwgQ0lTU1ANClN5c3RlbXMgRW5naW5l  
ZXINCkZvcmVTY291dCBUZWNobm9sb2dpZXMNCkNlbGw6ICAgICAgIDIwMS00  
NjMtNDA2NA0KT2ZmaWNlOi  
...

Does anyone have an example of how to handle this issue? The data needs to go into ES in human readable/searchable form.

thanks

---

<div class="post-metadata">

**Author:** ![Jackson\_Pollock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackson_pollock/32/37068_2.png) [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\
**Post date:** [November 7, 2018, 4:20pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585/2 "2018-11-07T16:20:24Z")

</div>

Seems like no one monitors this site.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 7, 2018, 9:19pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585/3 "2018-11-07T21:19:16Z")

</div>

> Seems like no one monitors this site.

Nonsense. People get answers to their questions all the time.

Logstash doesn't have a filter to do what you want so you'd have to write a plugin of your own.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2018, 9:19pm UTC](https://discuss.elastic.co/t/email-formatting-for-es-with-logstash-pipline/155585/4 "2018-12-05T21:19:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.