This plugin is used to read emails from an IMAP server. This plugin can be used to read emails and, depending on the email context, the subject of the email, or specific senders, it can be conditionally processed in Logstash and used to raise JIRA tickets, pagerduty events, and so on. The required configurations are host, password, and user. Depending on the settings that are required by the IMAP server that you want to connect to, you might need to set values for additional configurations, such as port, secure, and so on. host is where you would specify your IMAP server host details, and user and password are where you need to specify the user credentials to authenticate/connect to the IMAP server:

#email_log.conf
input { 
    imap {
      host => "imap.packt.com"
      password => "secertpassword"
      user => "[email protected]"
      port => 993
      check_interval => 10
      folder => "Inbox"
 
    }
} 

 
output {
    stdout { 
        codec => rubydebug 
    }
    elasticsearch {
      index => "emails"
      document_type => "email"
      hosts => "localhost:9200"
    }
   
}

By default, the logstash-input-imap plugin reads from the INBOX folder, and it polls the IMAP server every 300 seconds. In the preceding configuration, when using the check_interval parameter, the interval is overridden every 10 seconds. Each new email would be considered an event, and as per the preceding configuration, it would be sent to the standard output and Elasticsearch.