Supported editions for this feature: Frontline Starter and Frontline Standard; Business Starter, Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; Nonprofits; G Suite Basic and G Suite Business. Compare your edition
This article is for Google Workspace administrators
This article is for administrators or other people who manage the email system for their organization, for example their work or school. If you have a personal Gmail account and need help finding missing Gmail messages, visit Gmail messages are missing.
Use Email Log Search (ELS) to find and review email messages that people in your organization send and receive. You can find all messages, or search for specific messages by sender, date, or message ID. You can optionally download your ELS results to Google Sheets or .csv file.
With ELS, you can search for messages with a predefined search, using default search criteria already defined for you, or a custom search, using your own search criteria.
ELS isn't available to resellers who manage their customers’ Google Workspace subscriptions. Learn more about Google Workspace resellers.
Searching for messages with ELS
ELS helps you find missing email messages, and troubleshoot why messages weren’t delivered as expected. You can also check the status of messages after they’re delivered, including information about message labels, message location, whether the message was marked as spam, and if the message was deleted after delivery.
ELS lets you search for messages with different types of criteria:
- Based on senders or recipients in your organization.
- By email address, IP address, or domain.
- Within a predefined time range, or within a custom date range that you specify.
- Sent to Google Groups, or to other mailing lists, in your organization.
These are some helpful tips for using ELS to find messages.
Limits for messages older than 30 days
ELS has some limitations when searching for messages older than 30 days:
- You can't search with a Google Group email address.
- The recipient email address and the message ID are required.
- ELS provides message post-delivery status only. Message delivery status isn't available for messages older than 30 days.
Search results limits
In one search, ELS can get up to:
- 1,000 messages
- 15,000 log entries per message
Log entries for a message show a status for each step of message delivery. Each message typically has 5–7 log entries per recipient. So, messages sent to large groups with many recipients can have more than 15,000 log entries.
The time it takes to get your search results depends on how many messages are returned in the search. For a large number of messages, ELS results can take up to an hour.
Narrow your search
You might see this message when using ELS to find a message with a large number of recipients: Your search is too wide to show all the messages. Consider narrowing the search criteria.
To narrow your search, use the message recipient as the only search criteria. If you’re looking for a specific message that was sent to many recipients, do a search using the message ID and a specific recipient.
You can also narrow your search by adding other search conditions, or by selecting a shorter time range.
Find messages with ELS predefined search
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
Reporting
Email Log Search.
- Click the Predefined search tab. The next time you use ELS, the Predefined search tab will be selected by default.
- On the Predefined search tab, select an option from the Predefined search menu:
Option Description All messages from today Search for all messages sent to or from all users in your organization during the current day, starting at 12 AM local time. All messages since yesterday Search for all messages sent to or from all users in your organization within the past 48 hours. The 48-hour time range starts on the previous day, at 12 AM local time. All messages in the last 7 days Search for all messages sent to or from all users in your organization within the past 7 days. The 7-day time range starts 7 days before the current day, at 12 AM local time.
Messages sent from your domain since yesterday Search for all outgoing messages sent from your domain within the past 48 hours. Messages received from your domain since yesterday Search for all incoming messages sent to recipients in your domain within the past 48 hours. - Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.
Find messages with ELS custom search
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
- Click the Custom Search tab. The next time you use ELS, the Custom Search tab will be selected by default.
- On the Custom Search tab, enter search criteria in one or more of these fields. All fields except Date are optional, unless the selected date range is Older than 30 days:
Field Description Date Select a date range option for the search (required):
- Today
- Since yesterday
- Last 7 days
- Specify range: Specify a custom date range within the past 30 days.
- Older than 30 days: If you select this option, you must enter the recipient’s complete email address and the message ID.
Sender Enter the sender’s complete email address, partial email address, or Return-Path address. The Return-Path email address appears in the message header. Learn more about message headers.
Keep in mind:
- You can’t use wildcards in this field.
- For a partial email address search, you must enter at least 3 characters.
- To search for an exact match, enter the complete email address in quotes, for example, john@solarmora.com.
Recipient Search for messages sent to specific recipients or Google Groups.
For recipients, enter the recipient's complete or partial email address:
- Wildcards aren’t supported in this field.
- For a partial email address search, you must enter at least 3 characters.
- To search for an exact match, enter the complete email address in quotes, for example, john@solarmora.com.
For Groups, use the message ID to search for messages sent to a group email address. ELS results from a group email address search don’t include information about message delivery to individual group members.
Sender IP Enter the complete IP address of the message sender. Wildcards aren’t supported for this field.
Note: When you search by sender IP address, EL results might show a Google outbound IP address instead of the public outbound IP address for your domain. Gmail sends outgoing messages through Gmail servers, which use Google outbound IP addresses.
Recipient IP Enter the complete IP address of the message recipient. Wildcards aren’t supported for this field.
Subject Enter a message subject line or partial subject line. This field is not case sensitive.
Message ID Enter the message ID.
When you search using message ID, any date range you selected is ignored. All matching messages are returned in the search, even if they’re outside your selected time range.
Every email message has a unique message ID. The message ID appears in the message header, and is labeled Message-ID. Learn more about message headers. - Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.
Next steps
For help interpreting your ELS results, visit Understand Email Log Search results.
For help exporting ELS results, visit Export ELS results.
