Parse email message in Logstash

Elastic Stack Logstash
1

Hi,
I use imap-plugin in Logstash.
How can I parse email message.

I receive log from server with long message. I need one sentense of them not whole message.
Thank you.

2

Logstash might not be a very good fit for this task. If you give a specific example of such a message and what you want to extract from it we might be able to help out with a specific configuration to accomplish that.

3

Hi Magnus. Thank you.

I need only this bold text

message:
Time: Wed Mar 9 20:11:34 2016 +0100
Type: LOCALRELAY, Local Account - nobody
Count: 101 emails relayed
Blocked: No

Sample of the first 10 emails:

2016-03-09 20:05:47 1adjQZ-001coP-F9 <= raquel_robinson@nesto.com U=nobody P=local S=1525 id=3d19fbca7e36299fae8873113ca79e3f@nesto.com T="She'll never complain about sxx with you" for siasia@hotmail.my
2016-03-09 20:05:47 1adjQZ-001coc-LO <= raquel_robinson@nesto.com U=nobody P=local S=1549 id=26d0a09ffbfb5b4b40f28589b68b4514@nesto.com T="She'll never complain about sxx with you" for garfield25779@yahoo.com
2016-03-09 20:05:47 1adjQZ-001cop-PN <= cheryl_erickson@nesto.com U=nobody P=local S=1539 id=7cdff4f701ae5a3fef57704663f8fcbc@nesto.com T="This thing made me forget about any sxx problems" for abo1zed@hotmail.com
2016-03-09 20:05:47 1adjQZ-001cp2-TF <= raquel_robinson@nesto.com U=nobody P=local S=1519 id=818f85a45048641909e35a98906ff0d9@nesto.com T="She'll never complain about sxx with you" for sv2009@abv.bg

.

4

You'll probably want to use the multiline codec to combine the lines of the email into a single string that you can feed to the grok filter for parsing. Alternatively the aggregate filter can be used. I'm afraid I don't have time to write up an example of either solution.

5

OK, thank you Magnus.
I don`t know how to do this but never mind.

Thank you, again.