title: Logstash Ruby Filter to match email addresses
body: <p>I have a ruby filter to hopefully match an email address in a log message, remove it, and to pass it through an anonymization filter, something like this...</p>
  
  <pre><code>  ruby { 
    code =&gt;
      "
      begin
        if !event['log_message'].nil?
          if match = event['log_message'].match(/(\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b)/i) 
            event['user_email'] = match[1]
          end
        else
          puts 'Oddity parsing message: log_message is nil'
          puts event.to_yaml
        end
      rescue Exception =&gt; e
        puts 'Exception parsing user email:'
        puts e.message
      end
      "
  }
  if [user_email] {
    anonymize {  
      algorithm =&gt; "SHA1"
      fields =&gt; ["user_email"]
      key =&gt; "mySuperSecretPassword"
    }
    ruby {
      code =&gt;
        "
        begin
          event['message'].gsub!(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b/i, event['user_email'])
          event['log_message'].gsub!(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b/i, event['user_email'])
        rescue Exception =&gt; e
          puts 'Exception replacing user-email in log:'
          puts e.message
        end
        "
        remove_field =&gt; ["user_email"]              
    }
  }
  </code></pre>
  
  <p>As of now, this regex isn't catching much of anything.  I tried replacing it and I got an error (which was the "oddity parsing message" branch of my code).</p>
  
  <p>Does anyone know roughly how to do this?  I don't need a crazy over-the-top regex, just one to catch 99% of email addresses.  The regex I tried to use was </p>
  
  <pre><code>if match = event['log_message'].match(/(\b[a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:\.(?:[0-9A-Za-z][0-‌​9A-Za-z-]{0,62}))*\b)/i)
  </code></pre>
  
  <p>Here's a log line for reference</p>
  
  <pre><code>76817815   11/Jun/2016 00:04:28 +0000  INFO  [eventListener-3] messagingsvc logDefault    &gt; doSend - Sending email... From: "Test" &lt;do-not-reply@test.com&gt;
  </code></pre>
  
  <p><strong>Note</strong> If this can be done easier / in a more sane way using Grok, I'm completely open to removing the ruby bit.</p>