# Ingest Email Bounces

**URL:** <https://discuss.elastic.co/t/ingest-email-bounces/243396>\
**Category:** Logstash\
**Created:** [July 31, 2020, 8:08pm UTC](https://discuss.elastic.co/t/ingest-email-bounces/243396 "2020-07-31T20:08:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xzelkworld](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xzelkworld/32/45765_2.png) [@xzelkworld](https://discuss.elastic.co/u/xzelkworld)\
**Post date:** [July 31, 2020, 8:08pm UTC](https://discuss.elastic.co/t/ingest-email-bounces/243396/1 "2020-07-31T20:08:03Z")

</div>

We have Email bounce. They are in Email Mailbox format, but they are stored on Linux. Currently we have to set up complicate infrastructure to handle such Email Mailbox format ingestion processing. Is there a modern way to ingest Email Mailbox file to logstash then store them into Elasticsearch?

Example bounce back message:

```auto
    Return-Path: <someone@xyz.com>
    Received: from ..
    Received: from ..
    To: <anotherone@abc.com>
    Message-ID: <id>
    Date: Wed, 8 Jul 2020 09:45:00 -0700
    From: "XYZ" <someone@xyz.com>
    Subject: bounce
    Content-Language: en-us
    MIME-Version: 1.0
    Content-Transfer-Encoding: 8bit
    Content-Type: multipart/alternative;
            boundary="----=Part.1234567"

    ------=Part.1234567
    Content-Transfer-Encoding: 8bit
    Content-Type: text/plain; charset="UTF-8"
    ...

```

Xinhuan

---

<div class="post-metadata">

**Author:** ![duc00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/duc00/32/68773_2.png) [@duc00](https://discuss.elastic.co/u/duc00)\
**Post date:** [July 31, 2020, 10:15pm UTC](https://discuss.elastic.co/t/ingest-email-bounces/243396/2 "2020-07-31T22:15:44Z")

</div>

Hello Xinhuan,

There would definitely be ways to parse and process these kind of messages. I suggest you looking at [Logstash](https://www.elastic.co/guide/en/logstash/current/index.html) or the [Elasticsearch Ingest](https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html). They both provide extensive and flexible capabilities to do that. Logstash would run out of the Elasticsearch cluster and would then send the output to it and Ingest would be part of the cluster (with possibility to define dedicated Ingest nodes).

I had to make the choice between the two of them and I chose the Ingest solution to keep everything in one single place. [This article](https://www.elastic.co/blog/should-i-use-logstash-or-elasticsearch-ingest-nodes) discussing both helped me.

Let me know if this answers your question,  
duc00

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2020, 10:15pm UTC](https://discuss.elastic.co/t/ingest-email-bounces/243396/3 "2020-08-28T22:15:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.