Find messages with Email Log Search

Use Email Log Search (ELS) to find, and review details about, email messages sent and received by people in your organization. You can find all messages, or search for specific messages by sender, date, or message ID. Search for messages using a predefined search with default search criteria, or using a custom search with your own criteria. You can optionally download your ELS results to Google Sheets or .csv file.

You can't view message contents using ELS. Google Workspace provides other features that let admins view and manage message contents, including Gmail content compliance rules, Gmail delegation, and Google Vault.

ELS isn't available to resellers who manage their customers’ Google Workspace subscriptions. Learn more about Google Workspace resellers.

Searching for messages with ELS

ELS helps you find missing email messages, and troubleshoot why messages weren’t delivered as expected. You can also check the status of messages after they’re delivered, including information about message labels, message location, whether the message was marked as spam, and if the message was deleted after delivery.

ELS lets you search for messages with different types of criteria: 

• Based on senders or recipients in your organization.
• By email address, IP address, or domain.
• Within a predefined time range, or within a custom date range that you specify.
• Sent to Google Groups, or to other mailing lists, in your organization.

Find messages with ELS predefined search

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  ReportingEmail Log Search.
3. Click the Predefined search tab. The next time you use ELS, the Predefined search tab will be selected by default.
4. On the Predefined search tab, select an option from the Predefined search menu:
    

   Option	Description
   All messages from today	Search for all messages sent to or from all users in your organization during the current day, starting at 12 AM local time.
   All messages since yesterday	Search for all messages sent to or from all users in your organization within the past 48 hours. The 48-hour time range starts on the previous day, at 12 AM local time.
   All messages in the last 7 days	Search for all messages sent to or from all users in your organization within the past 7 days. The 7-day time range starts 7 days before the current day, at 12 AM local time.
   Messages sent from your domain since yesterday	Search for all outgoing messages sent from your domain within the past 48 hours.
   Messages received from your domain since yesterday	Search for all incoming messages sent to recipients in your domain within the past 48 hours.

5. Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.

Find messages with ELS custom search

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  ReportingEmail Log Search.
3. Click the Custom Search tab. The next time you use ELS, the Custom Search tab will be selected by default.
4. On the Custom Search tab, enter search criteria in one or more of these fields. All fields except Date are optional, unless the selected date range is Older than 30 days:
    

   Field	Description
   Date	Select a date range option for the search (required): Today Since yesterday Last 7 days Specify range: Specify a custom date range within the past 30 days. Older than 30 days: If you select this option, you must enter the recipient’s complete email address and the message ID.
   Sender	Enter the sender’s complete email address, partial email address, or Return-Path address. The Return-Path email address appears in the message header. Learn more about message headers. Keep in mind: You can’t use wildcards in this field. For a partial email address search, you must enter at least 3 characters. To search for an exact match, enter the complete email address in quotes, for example, [email protected].
   Recipient	Search for messages sent to specific recipients or Google Groups. For recipients, enter the recipient's complete or partial email address: Wildcards aren’t supported in this field. For a partial email address search, you must enter at least 3 characters. To search for an exact match, enter the complete email address in quotes, for example, [email protected]. For Groups, use the message ID to search for messages sent to a group email address. ELS results from a group email address search don’t include information about message delivery to individual group members.
   Sender IP	Enter the complete IP address of the message sender. Wildcards aren’t supported for this field. Note: When you search by sender IP address, EL results might show a Google outbound IP address instead of the public outbound IP address for your domain. Gmail sends outgoing messages through Gmail servers, which use Google outbound IP addresses.
   Recipient IP	Enter the complete IP address of the message recipient. Wildcards aren’t supported for this field.
   Subject	Enter a message subject line or partial subject line. This field is not case sensitive.
   Message ID	Enter the message ID. When you search using message ID, any date range you selected is ignored. All matching messages are returned in the search, even if they’re outside your selected time range. Every email message has a unique message ID. The message ID appears in the message header, and is labeled Message-ID. Learn more about message headers.

5. Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.

Next steps

For help interpreting your ELS results, visit Understand Email Log Search results.

For help exporting ELS results, visit Export ELS results.