Logstash Ruby Filter to match email addresses
<p>I have a ruby filter to hopefully match an email address in a log message, remove it, and to pass it through an anonymization filter, something like this...</p>

<pre><code>  ruby { 
  code =&gt;
    "
    begin
      if !event['log_message'].nil?
        if match = event['log_message'].match(/(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)/i) 
          event['user_email'] = match[1]
        end
      else
        puts 'Oddity parsing message: log_message is nil'
        puts event.to_yaml
      end
    rescue Exception =&gt; e
      puts 'Exception parsing user email:'
      puts e.message
    end
    "
}
if [user_email] {
  anonymize {  
    algorithm =&gt; "SHA1"
    fields =&gt; ["user_email"]
    key =&gt; "mySuperSecretPassword"
  }
  ruby {
    code =&gt;
      "
      begin
        event['message'].gsub!(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b/i, event['user_email'])
        event['log_message'].gsub!(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b/i, event['user_email'])
      rescue Exception =&gt; e
        puts 'Exception replacing user-email in log:'
        puts e.message
      end
      "
      remove_field =&gt; ["user_email"]              
  }
}
</code></pre>

<p>As of now, this regex isn't catching much of anything.  I tried replacing it and I got an error (which was the "oddity parsing message" branch of my code).</p>

<p>Does anyone know roughly how to do this?  I don't need a crazy over-the-top regex, just one to catch 99% of email addresses.  The regex I tried to use was </p>

<pre><code>if match = event['log_message'].match(/(\b[a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:\.(?:[0-9A-Za-z][0-‌​9A-Za-z-]{0,62}))*\b)/i)
</code></pre>

<p>Here's a log line for reference</p>

<pre><code>76817815   11/Jun/2016 00:04:28 +0000  INFO  [eventListener-3] messagingsvc logDefault    &gt; doSend - Sending email... From: "Test" &lt;do-not-reply@test.com&gt;
</code></pre>

<p><strong>Note</strong> If this can be done easier / in a more sane way using Grok, I'm completely open to removing the ruby bit.</p>