# Imap input plugin download attachment

**URL:** <https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966>\
**Category:** Logstash\
**Created:** [December 17, 2020, 8:58am UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966 "2020-12-17T08:58:15Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava1/32/78687_2.png) [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\
**Post date:** [December 17, 2020, 8:58am UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/1 "2020-12-17T08:58:16Z")

</div>

Hi,

I am using imap input plugin to fetch email along with attachments. Below configuration gets me multiple fields but does not get the attachment content.  
Can anyone help here how to download attachments while connection with imap

` input { imap { host => "outlook.office365.com" port => 123 user => "user@abc.com" password => " ******" check_interval => 3600 fetch_count => 100 folder => "Inbox" content_type => "application/gzip" } }`

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 17, 2020, 10:56am UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/2 "2020-12-17T10:56:23Z")

</div>

try to add [save\_attachments](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-imap.html#plugins-inputs-imap-save_attachments) parameter  
When set to true the content of attachments will be included in the `attachments.data` field.

```auto
input { 
	imap { 
			host => "outlook.office365.com" 
			port => 123 
			user => "user@abc.com" 
			password => " ******" 
			check_interval => 3600 
			fetch_count => 100 
			folder => "Inbox" 
			content_type => "application/gzip" 
			save_attachments => true
		}
	}

```

---

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava1/32/78687_2.png) [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\
**Post date:** [December 17, 2020, 12:37pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/3 "2020-12-17T12:37:35Z")

</div>

> [@ylasri](#):
>
> `save_attachments => true`

Hi,

Thanks for the reply  
I tried adding this parameter, but it gives error

[ERROR] 2020-12-17 12:36:28.400 [Converge PipelineAction::Create] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Java::JavaLang::IllegalStateException", :message=\>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.",

\*\* Only change I did was  
save\_attachments =\> true

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 17, 2020, 1:19pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/4 "2020-12-17T13:19:22Z")

</div>

What version of logstash are you using ?  
I guess this option has been introduced with logstash 7.9.0 (check it [here](https://www.elastic.co/guide/en/logstash/current/logstash-7-9-0.html))

---

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava1/32/78687_2.png) [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\
**Post date:** [December 17, 2020, 1:22pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/5 "2020-12-17T13:22:58Z")

</div>

[INFO] 2020-12-17 13:23:04.243 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"7.8.0", "jruby.version"=\>"jruby 9.2.11.1 (2.5.7) 2020-03-25 b1f55b1a40 OpenJDK 64-Bit Server VM 25.262-b10 on 1.8.0\_262-b10 +indy +jit [linux-x86\_64]"}  
[INFO] 2020-12-17 13:23:08.562 [Converge PipelineAction::Create] Reflections - Reflections took 127 ms to scan 1 urls, producing 21 keys and 41 values  
[ERROR] 2020-12-17 13:23:09.082 [Converge PipelineAction::Create] imap - Unknown setting 'save\_attachments' for imap

Its 7.8.0

---

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava1/32/78687_2.png) [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\
**Post date:** [December 17, 2020, 1:24pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/6 "2020-12-17T13:24:48Z")

</div>

Ok..Let me try it out with 7.9 then..I am using 7.8 right now.

---

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava1/32/78687_2.png) [@Aditya\_Srivastava1](https://discuss.elastic.co/u/Aditya_Srivastava1)\
**Post date:** [December 17, 2020, 5:13pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/7 "2020-12-17T17:13:26Z")

</div>

Thanks @ylasri, its working with 7.9.x version of logstash. Only prob now is that attachments.data is encrypted and not in human readable format and so cant apply parsing to it.

Probably need to use some python code to fetch attachment, store at a location and then use logstash to read the file and parse it.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 17, 2020, 5:15pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/8 "2020-12-17T17:15:53Z")

</div>

Check if the content is not base64 encoded ?

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [December 17, 2020, 5:30pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/9 "2020-12-17T17:30:51Z")

</div>

Yes it's base64 encoded and then you can use an other elasticsearch plugin [Ingest Attachment Processor](https://www.elastic.co/guide/en/elasticsearch/plugins/master/ingest-attachment.html) to ge the content of the attachmenet with an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/plugins/current/using-ingest-attachment.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2021, 5:31pm UTC](https://discuss.elastic.co/t/imap-input-plugin-download-attachment/258966/10 "2021-01-14T17:31:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.