Find messages with Email Log Search

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Starter, Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, and Education Plus; Nonprofits; G Suite Basic and G Suite Business. Compare your edition

This article is for Google Workspace administrators

This article is for administrators or other people who manage the email system for their organization, for example their work or school. If you have a personal Gmail account and need help finding missing Gmail messages, visit Gmail messages are missing.

Use Email Log Search (ELS) to find, and review details about, email messages sent and received by people in your organization. You can find all messages, or search for specific messages by sender, date, or message ID. Search for messages using a predefined search with default search criteria, or using a custom search with your own criteria. You can optionally download your ELS results to Google Sheets or .csv file.

You can't view message contents using ELS. Google Workspace provides other features that let admins view and manage message contents, including Gmail content compliance rules, Gmail delegation, and Google Vault.

ELS isn't available to resellers who manage their customers’ Google Workspace subscriptions. Learn more about Google Workspace resellers.

Searching for messages with ELS

ELS helps you find missing email messages, and troubleshoot why messages weren’t delivered as expected. You can also check the status of messages after they’re delivered, including information about message labels, message location, whether the message was marked as spam, and if the message was deleted after delivery.

ELS lets you search for messages with different types of criteria: 

  • Based on senders or recipients in your organization.
  • By email address, IP address, or domain.
  • Within a predefined time range, or within a custom date range that you specify.
  • Sent to Google Groups, or to other mailing lists, in your organization.
Tips for searching with ELS

These are some helpful tips for using ELS to find messages.

Limits for messages older than 30 days

ELS has some limitations when searching for messages older than 30 days:

Search results limits

In one search, ELS can get up to:

  • 1,000 messages
  • 15,000 log entries per message

Log entries for a message show a status for each step of message delivery. Each message typically has 5–7 log entries per recipient. So, messages sent to large groups with many recipients can have more than 15,000 log entries.

The time it takes to get your search results depends on how many messages are returned in the search. For a large number of messages, ELS results can take up to an hour. 

Narrow your search

You might see this message when using ELS to find a message with a large number of recipients: Your search is too wide to show all the messages. Consider narrowing the search criteria.

To narrow your search, use the message recipient as the only search criteria. If you’re looking for a specific message that was sent to many recipients, do a search using the message ID and a specific recipient. 

You can also narrow your search by adding other search conditions, or by selecting a shorter time range.

Find messages with ELS predefined search

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu and then Reportingand thenEmail Log Search.
  3. Click the Predefined search tab. The next time you use ELS, the Predefined search tab will be selected by default.
  4. On the Predefined search tab, select an option from the Predefined search menu:
     
    Option Description
    All messages from today Search for all messages sent to or from all users in your organization during the current day, starting at 12 AM local time.
    All messages since yesterday Search for all messages sent to or from all users in your organization within the past 48 hours. The 48-hour time range starts on the previous day, at 12 AM local time.
    All messages in the last 7 days

    Search for all messages sent to or from all users in your organization within the past 7 days. The 7-day time range starts 7 days before the current day, at 12 AM local time.

    Messages sent from your domain since yesterday Search for all outgoing messages sent from your domain within the past 48 hours.
    Messages received from your domain since yesterday Search for all incoming messages sent to recipients in your domain within the past 48 hours.
  5. Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.

Find messages with ELS custom search

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu and then Reportingand thenEmail Log Search.
  3. Click the Custom Search tab. The next time you use ELS, the Custom Search tab will be selected by default.
  4. On the Custom Search tab, enter search criteria in one or more of these fields. All fields except Date are optional, unless the selected date range is Older than 30 days:
     
    Field Description
    Date

    Select a date range option for the search (required):

    • Today
    • Since yesterday
    • Last 7 days
    • Specify range: Specify a custom date range within the past 30 days.
    • Older than 30 days: If you select this option, you must enter the recipient’s complete email address and the message ID.
    Sender

    Enter the sender’s complete email address, partial email address, or Return-Path address. The Return-Path email address appears in the message header. Learn more about message headers.

    Keep in mind:

    • You can’t use wildcards in this field.
    • For a partial email address search, you must enter at least 3 characters.
    • To search for an exact match, enter the complete email address in quotes, for example, john@solarmora.com.
    Recipient

    Search for messages sent to specific recipients or Google Groups.

    For recipients, enter the recipient's complete or partial email address:

    • Wildcards aren’t supported in this field.
    • For a partial email address search, you must enter at least 3 characters.
    • To search for an exact match, enter the complete email address in quotes, for example, john@solarmora.com.

    For Groups, use the message ID to search for messages sent to a group email address. ELS results from a group email address search don’t include information about message delivery to individual group members.

    Sender IP

    Enter the complete IP address of the message sender. Wildcards aren’t supported for this field.

    Note: When you search by sender IP address, EL results might show a Google outbound IP address instead of the public outbound IP address for your domain. Gmail sends outgoing messages through Gmail servers, which use Google outbound IP addresses.

    Recipient IP

    Enter the complete IP address of the message recipient. Wildcards aren’t supported for this field.

    Subject

    Enter a message subject line or partial subject line. This field is not case sensitive.

    Message ID

    Enter the message ID.

    When you search using message ID, any date range you selected is ignored. All matching messages are returned in the search, even if they’re outside your selected time range.

    Every email message has a unique message ID. The message ID appears in the message header, and is labeled Message-ID. Learn more about message headers.
  5. Click Search. Search results are returned within 1 minute to 1 hour, depending on how many messages are in the search results.

Next steps

For help interpreting your ELS results, visit Understand Email Log Search results.

For help exporting ELS results, visit Export ELS results.

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
2613023357904526724
true
Search Help Center
true
true
true
true
true
73010
false
false