How to load Outlook data into Elasticsearch via Logstash

Elasticsearch is a popular distributed full-text search engine. By centrally storing data, you can perform ultra-fast searches, fine-tuning relevance, and powerful analytics with ease. Elasticsearch has a pipeline tool for loading data called "Logstash". You can use CData JDBC Drivers to easily import data from any data source into Elasticsearch for search and analysis.

This article explains how to use the CData JDBC Driver for Outlook to load data from Outlook into Elasticsearch via Logstash.

Using CData JDBC Driver for Outlook with Elasticsearch Logstash

• Install the CData JDBC Driver for Outlook on the machine where Logstash is running.
• The JDBC Driver will be installed at the following path (the year part, e.g. 20XX, will vary depending on the product version you are using). You will use this path later. Place this .jar file (and the .lic file if it's a licensed version) in Logstash.
  C:\Program Files\CData\CData JDBC Driver for API 20XX\lib\cdata.jdbc.api.jar
  
• Next, install the JDBC Input Plugin, which connects Logstash to the CData JDBC driver. The JDBC Plugin comes by default with the latest version of Logstash, but depending on the version, you may need to add it.
  https://www.elastic.co/guide/en/logstash/5.4/plugins-inputs-jdbc.html
• Move the CData JDBC Driver’s .jar file and .lic file to Logstash's "/logstash-core/lib/jars/".

Sending Outlook data to Elasticsearch with Logstash

Now, let's create a configuration file for Logstash to transfer Outlook data to Elasticsearch.

• Write the process to retrieve Outlook data in the logstash.conf file, which defines data processing in Logstash. The input will be JDBC, and the output will be Elasticsearch. The data loading job is set to run at 30-second intervals.
• Set the CData JDBC Driver's .jar file as the JDBC driver library, configure the class name, and set the connection properties to Outlook in the form of a JDBC URL. The JDBC URL allows detailed configuration, so please refer to the product documentation for more specifics.

Using OAuth Authentication

Microsoft Graph API uses OAuth 2.0 for authentication. You must register an application in the Microsoft Azure Portal to obtain OAuth credentials (Client ID and Client Secret).

Obtaining OAuth Credentials

1. Log in to the Azure Portal.
2. Navigate to Azure Active Directory > App registrations.
3. Click New registration to create a new application.
4. Enter an application name and select the appropriate account types.
5. Set the Redirect URI to your application's callback URL (e.g., http://localhost:33333 for desktop apps).
6. Click Register to create the application.
7. On the application overview page, copy the Application (client) ID - this is your OAuthClientId.
8. Navigate to Certificates & secrets and create a new client secret.
9. Copy the client secret value - this is your OAuthClientSecret.
10. Navigate to API permissions and add the required Microsoft Graph API permissions:
    • Mail.Read - For accessing email messages
    • Contacts.Read - For accessing contacts
    • Calendars.Read - For accessing calendar events
    • Tasks.Read - For accessing To Do tasks
    • offline_access - For obtaining refresh tokens
11. Click Grant admin consent to grant these permissions.

Connecting with OAuth

After setting the following connection properties, you are ready to connect:

• AuthScheme: Set this to OAuth.
• InitiateOAuth: Set this to GETANDREFRESH. The CData API Profile for Outlook will automatically walk through the OAuth process in order to obtain the access token.
• OAuthClientId: Set this to the Application (client) ID from Azure Portal.
• OAuthClientSecret: Set this to the client secret value from Azure Portal.
• TenantId: Set this to your Azure AD tenant identifier (GUID or domain name like 'contoso.onmicrosoft.com').
• CallbackURL: Set this to the Redirect URI you specified in your app registration (e.g., http://localhost:33333 for desktop apps).

Example connection string

Profile=C:\profiles\Outlook.apip;AuthScheme=OAuth;InitiateOAuth=GETANDREFRESH;OAuthClientId=your_client_id;OAuthClientSecret=your_client_secret;TenantId=your_tenant_id;CallbackUrl=http://localhost:33333;

Executing data movement with Logstash

Now let's run Logstash using the created "logstash.conf" file.

    logstash-7.8.0\bin\logstash -f logstash.conf

A log indicating success will appear. This means the Outlook data has been loaded into Elasticsearch.

For example, let's view the data transferred to Elasticsearch in Kibana.

    GET api_table/_search
    {
        "query": {
            "match_all": {}
        }
    }

We have confirmed that the data is stored in Elasticsearch.

By using the CData JDBC Driver for Outlook with Logstash, it functions as a Outlook connector, making it easy to load data into Elasticsearch. Please try the 30-day free trial.