# Parsing Emails with logstash **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2018, 3:35pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567 "2018-04-18T15:35:22Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 18, 2018, 3:35pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/1 "2018-04-18T15:35:23Z")
Hi, everyone! I'm newest in ELK, so I need help =) Could some one help me? I try to search some data from my email message. I used imap input plugin , but what should I use in filter? For example if i use rubydebug in stdout I see that : "message-id" =\> "", "from" =\> "", "x-ms-exchange-organization-authas" =\> "Anonymous", "x-ms-exchange-organization-authsource" =\> "", "date" =\> "", "@version" =\> "1", "@timestamp" =\> , "to" =\> "", "subject" =\> "Alert Summary: ", "received" =\> "", "content-type" =\> "text/html; charset=UTF-8", "mime-version" =\> "1.0", "message" =\> "SOME HTML TAGS", "return-path" =\> "", "content-transfer-encoding" =\> "7bit", "type" =\> "new\_type" And now I want if I see something in "subject" Then I must to parse HTML tags. How can I do this? My config file looks like : input { imap { type =\> "new\_type" host =\> "" user =\> "user" password =\> "pass" port =\> 143 secure =\> false check\_interval =\> 360 delete =\> false folder=\> "Inbox/Folder" } } filter { if [type] == "new\_type" { ``` } ``` } output { if [type] == "new\_type" { elasticsearch { hosts =\> ["host:9200"] index =\> "new\_type\_index" } } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 19, 2018, 7:17am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/2 "2018-04-19T07:17:17Z")
The `subject` field doesn't contain any HTML tags so I don't understand the question. Are you talking about the message body? ---
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 19, 2018, 7:36am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/3 "2018-04-19T07:36:57Z")
Hi, Magnus! Thanks for reply! Yes, I'm talking about message body. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 19, 2018, 8:03am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/4 "2018-04-19T08:03:51Z")
Logstash has no built-in filter for HTML stripping. While you might be able to ignore the fact that it's HTML and just treat it as plain text (it depends on what you want to do) I'd probably write a custom filter plugin for stripping the HTML markup from the field. ---
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 19, 2018, 8:33am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/5 "2018-04-19T08:33:00Z")
Did I understadn correct, I must write some regex if I want extract some data from message? Or I can use something else? Cause it will be a very huge regex =) Could you, please, write some examle of config file in this case? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 19, 2018, 8:35am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/6 "2018-04-19T08:35:40Z")
> Did I understadn correct, I must write some regex if I want extract some data from message? It depends on what the HTML looks like and what you want to extract from it. ---
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 19, 2018, 8:44am UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/7 "2018-04-19T08:44:51Z")
ohhh, ok, thanks for the quick answers! I will read how to write my own plugins. I like the idea of deleting HTML tags and trying to parse the text itself. I hope it will not be very difficult.... ---
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 19, 2018, 1:34pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/8 "2018-04-19T13:34:36Z")
Magnus! Can you help me, again ? =) I'm stuck again. How can I parse the text now? I did so that all key words are separated by a comma. And I know for sure that all words will always be in the same order. How do I now pull out certain keywords and assign them to other fields? For example : "Some text ,some text,INEED-THIS-ONE,next text,AND-I-ALSO-NEED-THIS " ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 19, 2018, 2:10pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/9 "2018-04-19T14:10:41Z")
You have several options: a csv or dissect filter would probably be the easiest. ---
**Author:** ![M\_B\_I](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@M\_B\_I](https://discuss.elastic.co/u/M_B_I)\ **Post date:** [April 20, 2018, 12:16pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/10 "2018-04-20T12:16:29Z")
Magnus! Thanks for help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2018, 12:16pm UTC](https://discuss.elastic.co/t/parsing-emails-with-logstash/128567/11 "2018-05-18T12:16:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.