Parse and ingest email files using logstack -- help needed

Elastic Stack Logstash
10

There are no fancy quoting or escaping features in logstash configs :slight_smile: Try this, with a literal newline embedded in the string

  grok {
    match => { "message" => "Date: (?<date>.*)
From: " }
  }

Note that using .* sometimes grabs a lot more than you want. These two variants may help you understand what it is doing. The first one says .* followed by a newline, which ends up consuming the entire message. The second says not-newline followed by a newline, which consumes the rest of the line. If the order of headers ever varies, you will need this one.

  grok {
    match => { "message" => "Date: (?<date1>.*)
" }
  }
  grok {
    match => { "message" => "Date: (?<date2>[^
]*)
" }
  }
1 Like