# Parse email message in Logstash

**URL:** <https://discuss.elastic.co/t/parse-email-message-in-logstash/44036>\
**Category:** Logstash\
**Created:** [March 10, 2016, 1:09pm UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036 "2016-03-10T13:09:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![petar.kozic](https://avatars.discourse-cdn.com/v4/letter/p/ccd318/32.png) [@petar.kozic](https://discuss.elastic.co/u/petar.kozic)\
**Post date:** [March 10, 2016, 1:09pm UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/1 "2016-03-10T13:09:18Z")

</div>

Hi,  
I use imap-plugin in Logstash.  
How can I parse email message.

I receive log from server with long message. I need one sentense of them not whole message.  
Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2016, 6:25pm UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/2 "2016-03-10T18:25:41Z")

</div>

Logstash might not be a very good fit for this task. If you give a specific example of such a message and what you want to extract from it we might be able to help out with a specific configuration to accomplish that.

---

<div class="post-metadata">

**Author:** ![petar.kozic](https://avatars.discourse-cdn.com/v4/letter/p/ccd318/32.png) [@petar.kozic](https://discuss.elastic.co/u/petar.kozic)\
**Post date:** [March 11, 2016, 8:09am UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/3 "2016-03-11T08:09:29Z")

</div>

Hi Magnus. Thank you.

I need only this bold text

message:   
**Time: Wed Mar 9 20:11:34 2016 +0100**  
**Type: LOCALRELAY, Local Account - nobody**  
**Count: 101 emails relayed**  
**Blocked: No**

**Sample of the first 10 emails:**

**2016-03-09 20:05:47 1adjQZ-001coP-F9 \<= [raquel\_robinson@nesto.com](mailto:raquel_robinson@nesto.com) U=nobody P=local S=1525 [id=3d19fbca7e36299fae8873113ca79e3f@nesto.com](mailto:id=3d19fbca7e36299fae8873113ca79e3f@nesto.com) T="She'll never complain about sxx with you" for [siasia@hotmail.my](mailto:siasia@hotmail.my)**  
2016-03-09 20:05:47 1adjQZ-001coc-LO \<= [raquel\_robinson@nesto.com](mailto:raquel_robinson@nesto.com) U=nobody P=local S=1549 [id=26d0a09ffbfb5b4b40f28589b68b4514@nesto.com](mailto:id=26d0a09ffbfb5b4b40f28589b68b4514@nesto.com) T="She'll never complain about sxx with you" for [garfield25779@yahoo.com](mailto:garfield25779@yahoo.com)  
2016-03-09 20:05:47 1adjQZ-001cop-PN \<= [cheryl\_erickson@nesto.com](mailto:cheryl_erickson@nesto.com) U=nobody P=local S=1539 [id=7cdff4f701ae5a3fef57704663f8fcbc@nesto.com](mailto:id=7cdff4f701ae5a3fef57704663f8fcbc@nesto.com) T="This thing made me forget about any sxx problems" for [abo1zed@hotmail.com](mailto:abo1zed@hotmail.com)  
2016-03-09 20:05:47 1adjQZ-001cp2-TF \<= [raquel\_robinson@nesto.com](mailto:raquel_robinson@nesto.com) U=nobody P=local S=1519 [id=818f85a45048641909e35a98906ff0d9@nesto.com](mailto:id=818f85a45048641909e35a98906ff0d9@nesto.com) T="She'll never complain about sxx with you" for [sv2009@abv.bg](mailto:sv2009@abv.bg)

.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 11, 2016, 8:18am UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/4 "2016-03-11T08:18:14Z")

</div>

You'll probably want to use the multiline codec to combine the lines of the email into a single string that you can feed to the grok filter for parsing. Alternatively the aggregate filter can be used. I'm afraid I don't have time to write up an example of either solution.

---

<div class="post-metadata">

**Author:** ![petar.kozic](https://avatars.discourse-cdn.com/v4/letter/p/ccd318/32.png) [@petar.kozic](https://discuss.elastic.co/u/petar.kozic)\
**Post date:** [March 11, 2016, 8:31am UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/5 "2016-03-11T08:31:59Z")

</div>

OK, thank you Magnus.  
I don`t know how to do this but never mind.

Thank you, again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036/6 "2017-07-06T05:07:26Z")

</div>