# How Filter Logs of Mdaemon?

**URL:** <https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055>\
**Category:** Logstash\
**Created:** [May 28, 2019, 10:18am UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055 "2019-05-28T10:18:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerard.ramos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard.ramos/32/46958_2.png) [@gerard.ramos](https://discuss.elastic.co/u/gerard.ramos)\
**Post date:** [May 28, 2019, 10:18am UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/1 "2019-05-28T10:18:37Z")

</div>

Hello

I'm new in Logstash and I was trying to filter the logs of Mdaemon to visualise it in Kibana. The logs are in a file and are formed by multiple lines. They are separated with dashes like this "----------". I leave an example here:

Sun 2019-05-26 00:01:09.462: ----------  
Sun 2019-05-26 00:01:09.230: Session 198339; child 0009  
Sun 2019-05-26 00:01:09.230: Accepting IMAP connection from 83.45.125.176:41354 to 10.0.11.53:993  
Sun 2019-05-26 00:01:09.291: SSL negotiation successful  
Sun 2019-05-26 00:01:09.291: --\> \* OK [grupantonio.com](http://grupantonio.com) IMAP4rev1 MDaemon 18.5.1 ready  
Sun 2019-05-26 00:01:09.592: \<-- 1 CAPABILITY  
Sun 2019-05-26 00:01:09.592: --\> \* CAPABILITY IMAP4rev1 NAMESPACE AUTH=CRAM-MD5 AUTH=LOGIN AUTH=PLAIN IDLE ACL UNSELECT UIDPLUS QUOTA BINARY XLIST SASL-IR  
Sun 2019-05-26 00:01:09.592: --\> 1 OK CAPABILITY completed  
Sun 2019-05-26 00:01:09.649: \<-- 2 LOGIN "acol@grupantonio.com" \*\*\*\*\*\*  
Sun 2019-05-26 00:01:09.654: Authenticated as [acol@grupantonio.com](mailto:acol@grupantonio.com)  
Sun 2019-05-26 00:01:09.688: --\> 2 OK LOGIN completed  
Sun 2019-05-26 00:01:09.735: \<-- 3 SELECT "INBOX"  
Sun 2019-05-26 00:01:09.749: --\> \* FLAGS (\Seen \Answered \Flagged \Deleted \Draft \Recent $Forwarded $MDNSent)  
Sun 2019-05-26 00:01:09.749: --\> \* 439 EXISTS  
Sun 2019-05-26 00:01:09.749: --\> \* 0 RECENT  
Sun 2019-05-26 00:01:09.749: --\> \* OK [UIDVALIDITY 1337788604] UIDs valid  
Sun 2019-05-26 00:01:09.749: --\> \* OK [UIDNEXT 32231] Predicted next UID  
Sun 2019-05-26 00:01:09.749: --\> \* OK [PERMANENTFLAGS (\Seen \Answered \Flagged \Deleted \Draft $Forwarded $MDNSent)] .  
Sun 2019-05-26 00:01:09.749: --\> 3 OK [READ-WRITE] SELECT completed  
Sun 2019-05-26 00:01:09.797: \<-- 4 UID SEARCH 1:439 SINCE 26-May-2019  
Sun 2019-05-26 00:01:09.803: --\> \* SEARCH  
Sun 2019-05-26 00:01:09.803: --\> 4 OK SEARCH completed  
Sun 2019-05-26 00:01:09.862: \<-- 5 UID SEARCH 1:439 SINCE 26-May-2019 NOT DELETED  
Sun 2019-05-26 00:01:09.866: --\> \* SEARCH  
Sun 2019-05-26 00:01:09.866: --\> 5 OK SEARCH completed  
Sun 2019-05-26 00:01:09.936: Socket connection closed by the other side (how rude!)  
Sun 2019-05-26 00:01:09.937: IMAP session terminated, (Bytes in/out: 853/2336)  
Sun 2019-05-26 00:01:09.937: ----------  
Sun 2019-05-26 00:01:09.746: Session 198340; child 0009  
Sun 2019-05-26 00:01:09.746: Accepting IMAP connection from 91.38.630.93:59716 to 10.0.11.53:143  
Sun 2019-05-26 00:01:09.748: --\> \* OK [grupantonio.com](http://grupantonio.com) IMAP4rev1 MDaemon 18.5.1 ready  
Sun 2019-05-26 00:01:09.925: \<-- 1 CAPABILITY  
Sun 2019-05-26 00:01:09.925: --\> \* CAPABILITY IMAP4rev1 NAMESPACE AUTH=CRAM-MD5 AUTH=LOGIN AUTH=PLAIN IDLE STARTTLS ACL UNSELECT UIDPLUS QUOTA BINARY XLIST SASL-IR  
Sun 2019-05-26 00:01:09.925: --\> 1 OK CAPABILITY completed  
Sun 2019-05-26 00:01:10.085: \<-- 2 LOGIN "Lluiso Ramones" \*\*\*\*\*\*  
Sun 2019-05-26 00:01:10.087: La cuenta no existe  
Sun 2019-05-26 00:01:10.087: \*\*\*\* ALERT \*\*\*\* Failed IMAP authentication attempt from 91.686.280.53 for "Lluiso [Ramones@grupantonio.com](mailto:Ramones@grupantonio.com)" [EvSecurity]  
Sun 2019-05-26 00:01:10.087: --\> 2 NO LOGIN failed  
Sun 2019-05-26 00:01:10.295: \<-- 3 LOGOUT  
Sun 2019-05-26 00:01:10.295: --\> \* BYE IMAP engine signing off (no errors)  
Sun 2019-05-26 00:01:10.295: --\> 3 OK LOGOUT completed  
Sun 2019-05-26 00:01:10.295: IMAP session complete, (Bytes in/out: 56/297)  
Sun 2019-05-26 00:01:10.296: ----------

How to indicate that the content of the message is all the text between the dashes??

Sorry for my bad english, i hope you can help me! Thx

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2019, 1:50pm UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/2 "2019-05-28T13:50:58Z")

</div>

> [@gerard.ramos](#):
>
> How to indicate that the content of the message is all the text between the dashes??

Use a [multiline](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) codec on your input.

---

<div class="post-metadata">

**Author:** ![gerard.ramos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard.ramos/32/46958_2.png) [@gerard.ramos](https://discuss.elastic.co/u/gerard.ramos)\
**Post date:** [May 28, 2019, 2:53pm UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/3 "2019-05-28T14:53:04Z")

</div>

I already tried and I can't get it to work

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2019, 3:15pm UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/4 "2019-05-28T15:15:50Z")

</div>

What have you tried and what do you not like about the result?

---

<div class="post-metadata">

**Author:** ![gerard.ramos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard.ramos/32/46958_2.png) [@gerard.ramos](https://discuss.elastic.co/u/gerard.ramos)\
**Post date:** [June 3, 2019, 2:39pm UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/5 "2019-06-03T14:39:01Z")

</div>

Hi Badger, I was moved to a other project, but thanks for your replys!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 2:39pm UTC](https://discuss.elastic.co/t/how-filter-logs-of-mdaemon/183055/6 "2019-07-01T14:39:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.