# Logstash Filters - Grok a email advice

**URL:** <https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349>\
**Category:** Logstash\
**Created:** [June 12, 2019, 7:57am UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349 "2019-06-12T07:57:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerard.ramos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard.ramos/32/46958_2.png) [@gerard.ramos](https://discuss.elastic.co/u/gerard.ramos)\
**Post date:** [June 12, 2019, 7:57am UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349/1 "2019-06-12T07:57:53Z")

</div>

Hi, I was trying to grok a email log message to take the email address and make a field of it. I google it and i don't find the patterns to do it. Any help please??

Message examples:

\*\*\*\* ALERT \*\*\*\* Failed IMAP authentication attempt from 218.64.57.12 for "test1@test.com" [EvSecurity]

\*\*\*\* ALERT \*\*\*\* Failed SMTP authentication attempt from 192.168.129.14 for "test2@test.com" [EvSecurity]

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [June 12, 2019, 12:19pm UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349/2 "2019-06-12T12:19:29Z")

</div>

Hi!

Didn't test it, but you should be able to use this as a starting point:

```
    grok {
    match => [
         "message", "^%{DATA:alertmessage} from %{IP:ipaddress} for \"%{NOTSPACE:email_address}\" \[EvSecurity\]$"
        ]
    }
```

---

<div class="post-metadata">

**Author:** ![gerard.ramos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard.ramos/32/46958_2.png) [@gerard.ramos](https://discuss.elastic.co/u/gerard.ramos)\
**Post date:** [June 12, 2019, 1:29pm UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349/3 "2019-06-12T13:29:14Z")

</div>

Thank you very much, it works perfect!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 12, 2019, 1:49pm UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349/4 "2019-06-12T13:49:49Z")

</div>

grok patterns are not anchored by default, so you could just use

```
grok { match => ["message", "%{EMAILADDRESS:email_address}"] }

```

to grab the email address.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2019, 1:49pm UTC](https://discuss.elastic.co/t/logstash-filters-grok-a-email-advice/185349/5 "2019-07-10T13:49:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.