Email log search export fields

Email Log Search (ELS) helps you find messages sent to and from people in your organization. This article explains the fields and values when you Export Email log search results to a report.

Field	Description
Message ID	Every email message has a unique message ID. The message ID is in the message header, and is labeled Message-ID. Learn more about message headers. Note: If SMTPIN_ADDED_REJECT_SESSION is in the Message ID field, and other message header fields are N/A, the message ID couldn’t be determined and SMTP relay rejected the message.
Start date	The date and time that this event started. For outgoing messages, this is often the date and time the message was sent. For incoming messages, it’s typically the time the mail server received the message.
End date	The date and time that the event ended
Sender	Email address of the person or entity that sent the message. If a delegated user sent the message on behalf of the sending account, the delegate's email address is also included. Devices, such as printers or scanners, or automated systems, such as a CRM system or a website “contact us” form, can also send messages.
Message size	Total file size of the message (including attachments), in bytes
Subject	The message subject line
Direction	Sent: An outgoing message sent from your domain. Received: An incoming message sent to your domain. Mixed: The message was sent and received within your domain.
Attachments	Number of files attached to the message
Recipient address	All message recipients
Event target	SMTP_IN: Message received a message from an SMTP server SMTP_OUT: Message delivered a message to an SMTP server LIST_SERVER: Message delivered to a list expansion service for group expansion GMAIL_INBOX : Message delivered a message to a Gmail mailbox INTERNAL_SERVER: Message was delivered, but Gmail marked the message as spam GMAIL_SPAM ARCHIVE_LIST_SERVER
Event date	The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message.
Event status	This is the message delivery status. For detailed definitions of each status, visit Email Log Search delivery status definitions.
Event target IP address	IP address of the entity that started the email transaction, for example the IP address of a device using the Gmail on a browser, or the IP address of a mobile device using a third-party app to send email.
Has encryption	Indicates whether the message was encrypted during transit
Event SMTP reply code	SMTP reply code. For more information, visit About SMTP error messages.
Event description	Information about the event, including SMTP return or error messages and bounce message descriptions.

Email Log Search (ELS) helps you find messages sent to and from people in your organization. This article explains the fields and values when you Export Email log search results to a report.

Field	Description
Message ID	Every email message has a unique message ID. The message ID is in the message header, and is labeled Message-ID. Learn more about message headers. Note: If SMTPIN_ADDED_REJECT_SESSION is in the Message ID field, and other message header fields are N/A, the message ID couldn’t be determined and SMTP relay rejected the message.
Start date	The date and time that this event started. For outgoing messages, this is often the date and time the message was sent. For incoming messages, it’s typically the time the mail server received the message.
End date	The date and time that the event ended
Sender	Email address of the person or entity that sent the message. If a delegated user sent the message on behalf of the sending account, the delegate's email address is also included. Devices, such as printers or scanners, or automated systems, such as a CRM system or a website “contact us” form, can also send messages.
Message size	Total file size of the message (including attachments), in bytes
Subject	The message subject line
Direction	Sent: An outgoing message sent from your domain. Received: An incoming message sent to your domain. Mixed: The message was sent and received within your domain.
Attachments	Number of files attached to the message
Recipient address	All message recipients
Event target	SMTP_IN: Message received a message from an SMTP server SMTP_OUT: Message delivered a message to an SMTP server LIST_SERVER: Message delivered to a list expansion service for group expansion GMAIL_INBOX : Message delivered a message to a Gmail mailbox INTERNAL_SERVER: Message was delivered, but Gmail marked the message as spam GMAIL_SPAM ARCHIVE_LIST_SERVER
Event date	The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message.
Event status	This is the message delivery status. For detailed definitions of each status, visit Email Log Search delivery status definitions.
Event target IP address	IP address of the entity that started the email transaction, for example the IP address of a device using the Gmail on a browser, or the IP address of a mobile device using a third-party app to send email.
Has encryption	Indicates whether the message was encrypted during transit
Event SMTP reply code	SMTP reply code. For more information, visit About SMTP error messages.
Event description	Information about the event, including SMTP return or error messages and bounce message descriptions.