Logstash email image problem

Hi everybody,

i try to send email from logstash version 7.8.0 but, images are never shown!
however attachments are added to email and can be opened!
i used different kind of images, none of them work ?
can someone help please

ruby {
  code => "

html_table += '<img src=\"/tmp/files/images/na.png\" />'

html_table += '<img src=\"https://picsum.photos/536/354\" />'

html_table += '<img src=\"data:image/jpeg;charset=utf-8;base64,  iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==   \" />'

    event.set('html_test', html_table)
  "
  }

output {
  email {
    address => ""
    port => 587
    via => "smtp"
    username => ""
    password => ""
    use_tls => true
    authentication => "login"
    from => ""
    to => ""
    subject => ""
    htmlbody => "%{html_test}"
    contenttype => "text/html; charset=UTF-8"
    attachments => ["/tmp/files/images/na.png", "/tmp/files/images/passed.png", "/tmp/files/images/failed.png"]
    debug => true
  }
}

My understanding (acquired this morning) is that to reference an image attachment in an email you need to use the content_id (see here and here).

The Ruby mail code appears to set the content_id to '' (see here, the hash in the caller never has :content_id set).

Check the mail that is sent. What are the content_id headers on each attachment? If they are set, then reference them in cid: URIs when trying to embed them.

I suspect they will not be set (the assumption being that they are only of use if the sender knows them, so they have to set them). I do not see any way for the use of the email output to set them, so referencing images in attachments may not be supported.

Attachments => Works Fine (The internal url is same)
KO = > HTML body with image are never shown : Internal Url, External Url, Embedded
What should i do exactly please?

Review the email that is sent and see what the content_id header on each attachment is.

I did not get excplicity CONTENT-ID but something like this :

MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="--==_mimepart_67978e0d733f8_1e21e808-3de"; charset="UTF-8"
Content-Transfer-Encoding: 7bit

If there is no content_id header then, as far as I understand it, you cannot reference it in a cid: URI, and cannot embed an attachment in the email.

I use logstash to send email depending of a query DSL from elasticsearch, so i should send mail with sunny image if everything is ok, do you have any other alternatives please ?

What should i do exactly please, i must send automatically a mail from logstash !

The email output will send email, but does not support displaying an image attachment embedded in the email.

1 Like

what a best solution, any alternative please in ELK stack please ?

I don't know of a way to do that.

i can send emails such as :
input : query DSL to get some documents
filter : aggregate those multiple documents into an HTML table
output : send mail via SMPT

this is working but unfortunatly the images are neved shown, even they are attached correctly, but never shown in the htmlbody ! may i should buy SEARCH GUARD ! Any suggestion please