Understand Email Log Search results

Email Log Search (ELS) helps you find messages sent to and from people in your organization. This article explains the information that you get when you Find messages with Email Log Search.

ELS results are returned in a summary table like this one:

1. Subject or Message ID	2. Date	3. Sender
The message subject line or the message ID. To get more details about an entry in the results table, click the subject or message ID in this column.	The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message.	The email address of the account that sent the message.

From the summary table, you can:

• Export ELS results
• Get more details about the messages in the ELS results

Export ELS results

You can optionally export ELS results to Google Sheets or to a .csv file.

When exporting ELS results, keep in mind:

• The download feature is available only when the results include exportable data.
• Data in the .csv file or spreadsheet is limited to 1000 messages.
• The .csv file doesn't include post-delivery message details.
• The .csv file or spreadsheet shows every delivery step for each message in your search results. So, the exported .csv file or spreadsheet has more entries than the number of messages returned in search results.

Export your ELS results:

1. At the top right of the ELS results table, click the arrow.
2. In the Download log search results box, choose an export format.
3. Click Download.

ELS detailed results

To get message and recipient details, click the message subject or message ID in the first column of the ELS results table.

Message details

To get detailed information about messages in your ELS results, click the message subject or message ID in the summary results table. The information below is on the Message details page.

Field	Description
Subject	The message subject line
Sender	Email address of the person that sent the message. If a delegated user sent the message on behalf of the sending account, the delegate's own email address is also shown.
Recipient	All message recipients. Click the arrow to show all recipients. To get recipient details, click any recipient email address.
Date	The date and time the message was reported as sent. Or, the date and time of the first time a log search entry appeared for the message.
Message ID	Every email message has a unique message ID. The message ID appears in the message header, and is labeled Message-ID. Learn more about message headers. Note: If SMTPIN_ADDED_REJECT_SESSION appears in the Message ID field, and other message header fields are N/A, the message ID couldn’t be determined and SMTP relay rejected the message.
Message size	Total file size of the message (including attachments), in kilobytes
Attachments	Number of files attached to the message
Direction	Sent: An outgoing message sent from your domain. Received: An incoming message sent to your domain. Mixed: The message was sent and received within your domain.
Status	The top number indicates how many times that the message was delivered. The bottom number indicates how many recipients the message was sent to.

Recipient details

Recipient details include all the addresses that the message was delivered to, and the delivery steps for each recipient. Under Recipient details, click a recipient email address to get detailed information about message delivery and post-delivery status for that recipient.

Field	Description
Date and time for each delivery step	Date and time are listed for each step during the message delivery process. Date and time are in the time zone of the Admin console device used to do the search. The delivery steps indicate whether the message was: Sent with TLS Delivered normally, or marked as spam Quarantined All message delivery statuses are described in Message delivery status.
Post-delivery message details	The status of the message after it was delivered to the recipient’s mailbox. A message can have a different post-delivery status for each recipient. All post-delivery statuses are described in Post-delivery message status. Post-delivery message status isn't available for messages sent to Google Groups.
Matched rules	If a message matches a compliance rule set up in Google Workspace, this field includes the rule name and description. Click the arrow next to the rule name to get more information, or to go to the rule in your Admin console. If the message triggered a content compliance or objectionable content rule, click the arrow next to the rule to learn what content triggered the rule. Any sensitive information in the content appears redacted. If the matched setting has changed since it was created, the link is to the current version of the setting. If the setting has been deleted, there's no link available.