User Guide


When the Email Collector receives a valid MIME email message as input, it parses it and produces a Tornado Event with the extracted data.

In order to forward the received Email Events to NetEye, relay all email sent to eventgw@domain on your SMTP server to the NetEye 4 Tornado Email Collector.

With the attachments included, the ones that are text files will be in plain text, otherwise they will be encoded in base64.

For example, passing this email with attachments:

From: "Francesco" <>
Subject: Test for Mail Collector - with attachments
To: "Benjamin" <>,
 francesco <>
Date: Sun, 02 Oct 2016 07:06:22 -0700 (PDT)
MIME-Version: 1.0
Content-Type: multipart/mixed;
Content-Language: en-US

This is a multi-part message in MIME format.
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>Test for Mail Collector with attachments</html>

Content-Type: application/pdf;
Content-Transfer-Encoding: base64
Content-Disposition: attachment;


Content-Type: text/plain; charset=UTF-8;
Content-Transfer-Encoding: base64
Content-Disposition: attachment;


will generate this Event:

  "type": "email",
  "created_ms": 1554130814854,
  "payload": {
    "date": 1475417182,
    "subject": "Test for Mail Collector - with attachments",
    "to": "\"Benjamin\" <>, francesco <>",
    "from": "\"Francesco\" <>",
    "cc": ",",
    "body": "<html>Test for Mail Collector with attachments</html>",
    "attachments": [
        "filename": "sample.pdf",
        "mime_type": "application/pdf",
        "encoding": "base64",
        "content": "JVBERi0xLjMNCiXi48/TDQoNCjEgMCBvYmoNCjw8DQovVHlwZSAvQ2F0YWxvZw0KT0YNCg=="
        "filename": "sample.txt",
        "mime_type": "text/plain",
        "encoding": "plaintext",
        "content": "txt file context for email Collector\n1234567890987654321\n"

Within the Tornado Event, the filename and mime_type properties of each attachment are the values extracted from the incoming email.

Instead, the encoding property refers to the content encoding in the Event itself, which is one of two types:

  • plaintext: The content is included in plain text

  • base64: The content is encoded in base64