# More easily track a single email between services and servers **URL:** \ **Category:** Kibana\ **Created:** [February 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752 "2021-02-09T15:17:46Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jmcclelland](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Post date:** [February 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752/1 "2021-02-09T15:17:46Z")
Hi all, We are sending our postfix logs to elasticsearch using journalbeat. Our email system sends messages from one server to another and on a given server, from one service to another service (spam checking etc). Each time it gets a new message id. If I want to know what happened to a single email message, I open up Kibana Discover and find the first message id. Then I have to keep altering my search parameters to trace it from one place to the next. All of this works and is more convenient then logging into multiple servers and grepping the logs. But... I was wonering if there is an easier way - any built in function that knows how to discover the next message id from the current one so I could just plug in one message id and see the entire trail? ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [February 10, 2021, 10:35am UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752/2 "2021-02-10T10:35:44Z")
Hi Quick question, that message id is generated by postfix? is the initial message id also part of the messages when it arrives at other services? What's the structure of the document when it's in ingested in Elasticsearch? Thx! Best, Matthias ---
**Author:** ![jmcclelland](https://avatars.discourse-cdn.com/v4/letter/j/dfb087/32.png) [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Post date:** [February 10, 2021, 1:49pm UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752/3 "2021-02-10T13:49:57Z")
Thanks for the follow up. Yes, the message id is generated by postfix and it is cleanly passed on for each step. Here's an example. - It starts on server foo with message id EF2DC3F27 - Then it gets passed on to server bar with message id A76481DCFF - Then it gets passed on to the next server with message id: DD20F405B5 ```auto Feb 03 12:22:27 foo postfix/smtp[4508]: EF2DC3F27: to=, relay=xxx.xxx.xxx[xxx.xxx.xxx.xxx]:25, delay=0.89, delays=0.49/0.01/0.13/0.25, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as A76481DCFF) Feb 04 09:42:10 bar postfix/smtpd[6085]: A76481DCFF: client=foo[xx.xx.xx.xx] Feb 04 09:42:10 bar postfix/cleanup[6145]: A76481DCFF: message-id= Feb 04 09:42:10 bar postfix/qmgr[14059]: A76481DCFF: from=, size=22152, nrcpt=1 (queue active) Feb 04 09:42:10 bar postfix/smtp[6144]: A76481DCFF: to=, relay=xxx.xxx.xxx[xxx.xxx.xxx.xxx]:25, delay=0.23, delays=0.2/0/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as DD20F405B5) Feb 04 09:42:10 bar postfix/qmgr[14059]: A76481DCFF: removed ``` At the moment, the entire text is in one field, but I could use dissect to break out the message id for every line that has one. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 10, 2021, 1:50pm UTC](https://discuss.elastic.co/t/more-easily-track-a-single-email-between-services-and-servers/263752/4 "2021-03-10T13:50:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.