# Synchronize whole files (mostly PDFs) to ES from directory and e-mails

**URL:** https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962
**Category:** Logstash
**Created:** [July 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962 "2021-07-29T10:08:30Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![jporzelt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jporzelt/32/44645_2.png) [@jporzelt](https://discuss.elastic.co/u/jporzelt)
#### Post date: [July 29, 2021, 10:08am UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962/1 "2021-07-29T10:08:30Z")

</div>

Hi all,

we would like to setup a document synchronization from a file directory and from a e-mail imap folder to elasticsearch.

For the e-mails we are interested in the attachments. Here the [imap input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-imap.html) looks promising.

For the files (e.g. PDFs) we would like to setup a directory that gets scanned and whenever a new file is inserted the whole file content (e.g. as a byte array) gets transferred.  
Here the [file input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) looks like a candidate but maybe not. From the documentation it is not clear to me if we could configure it for the purpose I described.

Any opinions/suggestions? Maybe there are other plugins or totally different solutions out there, we are not aware of.

Thanks in advance,  
Johannes

---

<div class="post-metadata">

### Author: ![jporzelt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jporzelt/32/44645_2.png) [@jporzelt](https://discuss.elastic.co/u/jporzelt)
#### Post date: [August 2, 2021, 1:03pm UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962/2 "2021-08-02T13:03:43Z")

</div>

Nobody any experience in this topic or at least any suggestions/opinions?

---

<div class="post-metadata">

### Author: ![jporzelt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jporzelt/32/44645_2.png) [@jporzelt](https://discuss.elastic.co/u/jporzelt)
#### Post date: [August 5, 2021, 3:24pm UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962/3 "2021-08-05T15:24:38Z")

</div>

Actually the IMAP input worked quite well.

```auto
input {
  imap {
    ...
  }
}

filter {
  #duplicate event for each attachment
  split {
    field => "attachments"
  }
  if ".pdf" in [attachments][filename] {
    ...
  } else {
    #drop non-pdf attachments
    drop { }
  }
}

output {
  ...
}

```

---

<div class="post-metadata">

### Author: ![cknz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cknz/32/9640_2.png) [@cknz](https://discuss.elastic.co/u/cknz)
#### Post date: [August 9, 2021, 8:08am UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962/4 "2021-08-09T08:08:54Z")

</div>

The file input plugin will most emphatically not be your friend I think. Logstash is really mostly about... well Logs, and is not really kitted out for use as an generalised Elasticsearch ETL tool.

I would suggest something a bit more custom perhaps. Considering you're doing things with PDFs, you might want to check out more about Ingest Pipelines and what those might offer (sorry, I'm not familiar with non-Logs use-cases with Ingest Pipelines).

No experience with the imap plugin, but its interesting to see that it can do that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 6, 2021, 8:09am UTC](https://discuss.elastic.co/t/synchronize-whole-files-mostly-pdfs-to-es-from-directory-and-e-mails/279962/5 "2021-09-06T08:09:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
