Class: LogStash::Inputs::IMAP

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/imap.rb

Overview

Read mails from IMAP server

Periodically scan an IMAP folder (‘INBOX` by default) and move any read messages to the trash.

Instance Method Summary collapse

Instance Method Details

#check_mail(queue) ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/logstash/inputs/imap.rb', line 73

def check_mail(queue)
  # TODO(sissel): handle exceptions happening during runtime:
  # EOFError, OpenSSL::SSL::SSLError
  imap = connect
  imap.select(@folder)
  ids = imap.search("NOT SEEN")

  ids.each_slice(@fetch_count) do |id_set|
    items = imap.fetch(id_set, "RFC822")
    items.each do |item|
      next unless item.attr.has_key?("RFC822")
      mail = Mail.read_from_string(item.attr["RFC822"])
      if @strip_attachments
        queue << parse_mail(mail.without_attachments!)
      else
        queue << parse_mail(mail)
      end
    end

    imap.store(id_set, '+FLAGS', @delete ? :Deleted : :Seen)

  end

# Enable an 'expunge' IMAP command after the items.each loop
  if @expunge 
  # Force messages to be marked as "Deleted", the above may or may not be working as expected. "Seen" means nothing if you are going to
  # delete a message after processing.
    imap.store(id_set, '+FLAGS', [:Deleted])
    imap.expunge()
  end

  imap.close
  imap.disconnect
end

#connect ⇒ Object

def register



56
57
58
59
60
61
62
63
64
 
# File 'lib/logstash/inputs/imap.rb', line 56

def connect
  sslopt = @secure
  if @secure and not @verify_cert
      sslopt = { :verify_mode => OpenSSL::SSL::VERIFY_NONE }
  end
  imap = Net::IMAP.new(@host, :port => @port, :ssl => sslopt)
  imap.(@user, @password.value)
  return imap
end

#parse_mail(mail) ⇒ Object 



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
 
# File 'lib/logstash/inputs/imap.rb', line 108

def parse_mail(mail)
  # Add a debug message so we can track what message might cause an error later
  @logger.debug? && @logger.debug("Working with message_id", :message_id => mail.message_id)
  # TODO(sissel): What should a multipart message look like as an event?
  # For now, just take the plain-text part and set it as the message.
  if mail.parts.count == 0
    # No multipart message, just use the body as the event text
    message = mail.body.decoded
  else
    # Multipart message; use the first text/plain part we find
    part = mail.parts.find { |p| p.content_type.match @content_type_re } || mail.parts.first
    message = part.decoded
  end

  @codec.decode(message) do |event|
    # Use the 'Date' field as the timestamp
    event.timestamp = LogStash::Timestamp.new(mail.date.to_time)

    # Add fields: Add message.header_fields { |h| h.name=> h.value }
    mail.header_fields.each do |header|
      # 'header.name' can sometimes be a Mail::Multibyte::Chars, get it in String form
      name = @lowercase_headers ? header.name.to_s.downcase : header.name.to_s
      # Call .decoded on the header in case it's in encoded-word form.
      # Details at:
      #   https://github.com/mikel/mail/blob/master/README.md#encodings
      #   http://tools.ietf.org/html/rfc2047#section-2
      value = transcode_to_utf8(header.decoded.to_s)

      # Assume we already processed the 'date' above.
      next if name == "Date"

      case (field = event.get(name))
      when String
        # promote string to array if a header appears multiple times
        # (like 'received')
        event.set(name, [field, value])
      when Array
        field << value
        event.set(name, field)
      when nil
        event.set(name, value)
      end
    end

    decorate(event)
    event
  end
end

#register ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/logstash/inputs/imap.rb', line 37

def register
  require "net/imap" # in stdlib
  require "mail" # gem 'mail'

  if @secure and not @verify_cert
    @logger.warn("Running IMAP without verifying the certificate may grant attackers unauthorized access to your mailbox or data")
  end

  if @port.nil?
    if @secure
      @port = 993
    else
      @port = 143
    end
  end

  @content_type_re = Regexp.new("^" + @content_type)
end

#run(queue) ⇒ Object 



66
67
68
69
70
71
 
# File 'lib/logstash/inputs/imap.rb', line 66

def run(queue)
  @run_thread = Thread.current
  Stud.interval(@check_interval) do
    check_mail(queue)
  end
end

#stop ⇒ Object 



157
158
159
160
 
# File 'lib/logstash/inputs/imap.rb', line 157

def stop
  Stud.stop!(@run_thread)
  $stdin.close
end