# Logstash filter CSV inside email content

**URL:** <https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244>\
**Category:** Logstash\
**Created:** [December 17, 2021, 1:41am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244 "2021-12-17T01:41:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pcpdoc02](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pcpdoc02](https://discuss.elastic.co/u/pcpdoc02)\
**Post date:** [December 17, 2021, 1:41am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244/1 "2021-12-17T01:41:09Z")

</div>

I would like to use Logstash to stream CSV data in email to Elasticsearch. IMAP and CSV filter seems suitable to extract email content and parse the CSV contents respectively. How can I use both filter together to output CSV content to elastics search? Thanks!

```auto
{
 "date" => "Fri, 17 Dec2021 00:00:00 +0800",
 "subject" => "Test CSV inside email content",
 "message" => "<CSV data here>",
 "from" => "xxx <xxx@xxx>",
 "to" => "ttt <ttt@ttt>"
}

```

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [December 18, 2021, 11:27pm UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244/2 "2021-12-18T23:27:17Z")

</div>

The IMAP plugin is an input plugin and the CSV is a filter plugin and the Elasticsearch plugin is an output filter.  
Just define each one appropriately and it should work.

```auto
input {
    imap {
       ...
   }
}
filter {
   csv {
      ...
   }

}

output {
   elasticsearch {
        ....
}

```

---

<div class="post-metadata">

**Author:** ![pcpdoc02](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pcpdoc02](https://discuss.elastic.co/u/pcpdoc02)\
**Post date:** [December 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244/3 "2021-12-19T08:08:13Z")

</div>

Thank you for the response.

After some searching, I find that split filter is also required to split the event to multiple messages for csv filter to process. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2022, 8:09am UTC](https://discuss.elastic.co/t/logstash-filter-csv-inside-email-content/292244/4 "2022-01-16T08:09:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.