For When You Can't Have The Real Thing
[ start | index | login ]
start > ELK > Querying For Email Addresses

Querying For Email Addresses

Created by dave. Last edited by dave, 2 years and 185 days ago. Viewed 683 times. #1
[edit] [rdf]
labels
attachments
(2016-06-07)

Problem

I have a standard stream of sendmail logs that are being streamed into Elasticsearch more or less unfiltered using only

match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:syslog_message}" }
...way of doing things.

I want to search the resulting indexes for a particular email address.

Solution

To search for dave@xdroop.com, query for: dave AND @xdroop.com

This is a hack but it should return what you want. (Maybe with lots of stuff you don't want, I don't know. But at least I can find it now.)

no comments | post comment
This is a collection of techical information, much of it learned the hard way. Consider it a lab book or a /info directory. I doubt much of it will be of use to anyone else.

Useful:


snipsnap.org | Copyright 2000-2002 Matthias L. Jugel and Stephan J. Schmidt