Logstash input imap plugin with attachment not decoding

Elastic Stack Logstash
1

Hi,

I am trying to fetch emails with attachments from Office 365 using logstash and putting them on Kafka topic. During the process, I got to understand the logstash-imap-input plugin is unable to process it. When the attachment such as image is inline in the email, then I receive a kafka message with data encoded as base64.


input {
  imap {
    host => "outlook.office365.com"
    user => "*****"
    password => "****"
    secure => true
    folder => "INBOX"
    check_interval => 60 # Specified in seconds
    fetch_count => 10
    save_attachments => true
    attachments_target => "attachment"
    headers_target => "headers"
    # strip_attachments => true
    content_type => "multipart/mixed"
  } 
}

output {
  kafka {
    codec => json
    topic_id => "email"
    compression_type => gzip
    value_serializer => "org.apache.kafka.common.serialization.ByteArraySerializer"

  }
}

Error msg:


[2023-01-13T15:24:03,087][ERROR][logstash.inputs.imap     ][main][e29e62f1aee00e8c941cda3e54fc2c243d202fc7e24fb6edf819b64232b1da6c] Encountered error NoMethodError {:message=>"Can not decode an entire message, try calling #decoded on the various fields and body or parts if it is a multipart message.", :backtrace=>["/Users/anjul/Documents/Projects/***/logstash-8.6.0/vendor/bundle/jruby/2.6.0/gems/mail-2.6.6/lib/mail/message.rb:1903:in `decoded'", "/Users/anjul/Documents/Projects/****/logstash-8.6.0/vendor/bundle/jruby/2.6.0/gems/logstash-input-imap-3.2.0/lib/logstash/inputs/imap.rb:220:in `parse_mail'",

Let me know if you have any solution for this problem?

Thanks
Anjul

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.