Email Log Search (ELS) helps you find messages sent to and from people in your organization. This article explains the information that you get when you Find messages with Email Log Search.
ELS results are returned in a summary table like this one:
| 1. Subject or Message ID | 2. Date | 3. Sender |
|---|---|---|
| The message subject line or the message ID. To get more details about an entry in the results table, click the subject or message ID in this column. | The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message. | The email address of the account that sent the message. |
From the summary table, you can:
- Export ELS results
- Get more details about the messages in the ELS results
Export ELS results
You can optionally export ELS results to Google Sheets or to a .csv file.
When exporting ELS results, keep in mind:
- The download feature is available only when the results include exportable data.
- Data in the .csv file or spreadsheet is limited to 1000 messages.
- The .csv file doesn't include post-delivery message details.
- The .csv file or spreadsheet shows every delivery step for each message in your search results. So, the exported .csv file or spreadsheet has more entries than the number of messages returned in search results.
Export your ELS results:
- At the top right of the ELS results table, click the arrow.
- In the Download log search results box, choose an export format.
- Click Download.
ELS detailed results
To get message and recipient details, click the message subject or message ID in the first column of the ELS results table.
Message details
To get detailed information about messages in your ELS results, click the message subject or message ID in the summary results table. The information below is on the Message details page.
|
Field |
Description |
|---|---|
|
Subject |
The message subject line |
|
Sender |
Email address of the person that sent the message. If a delegated user sent the message on behalf of the sending account, the delegate's own email address is also shown. |
|
Recipient |
All message recipients. Click the arrow to show all recipients. To get recipient details, click any recipient email address. |
|
Date |
The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message. |
|
Message ID |
Every email message has a unique message ID. The message ID appears in the message header, and is labeled Message-ID. Learn more about message headers. Note: If SMTPIN_ADDED_REJECT_SESSION appears in the Message ID field, and other message header fields are N/A, the message ID couldn’t be determined and SMTP relay rejected the message. |
|
Message size |
Total file size of the message (including attachments), in kilobytes |
|
Attachments |
Number of files attached to the message |
|
Direction |
|
|
Status |
The top number indicates how many times that the message was delivered. The bottom number indicates how many recipients the message was sent to. |
Recipient details
Recipient details include all the addresses that the message was delivered to, and the delivery steps for each recipient. Under Recipient details, click a recipient email address to get detailed information about message delivery and post-delivery status for that recipient.
|
Field |
Description |
|---|---|
|
Date and time for each delivery step |
Date and time are listed for each step during the message delivery process. Date and time are in the time zone of the Admin console device used to do the search. The delivery steps indicate whether the message was:
All message delivery statuses are described in Message delivery status. |
|
Post-delivery message details |
The status of the message after it was delivered to the recipient’s mailbox. A message can have a different post-delivery status for each recipient. All post-delivery statuses are described in Post-delivery message status. Post-delivery message status isn't available for messages sent to Google Groups. |
|
Matched rules |
If a message matches a compliance rule set up in Google Workspace, this field includes the rule name and description. Click the arrow next to the rule name to get more information, or to go to the rule in your Admin console. If the message triggered a content compliance or objectionable content rule, click the arrow next to the rule to learn what content triggered the rule. Any sensitive information in the content appears redacted. If the matched setting has changed since it was created, the link is to the current version of the setting. If the setting has been deleted, there's no link available. |
