A system, method, and program for the processing of large amounts of email based on user-configurable criteria in close to real-time. The invention enables filtering of all journaled emails in an organization for the duration of a regulatory proceeding, or for audit purposes, thus greatly reducing the manual effort required to produce a targeted set of emails. The journaling feature copies all unique emails coming through the distributed email server farm to a smaller set of email mailboxes. The filtering application could run as a batch operation on each of those “journaling” mailboxes at periodic intervals or could run interactively. The user-defined filter criteria are applied to the emails filling up the “journaling” mailboxes, and matches are separated from the non-matches for analysis. The invention can be executed on offline data, such as personal message stores or individual compound message files.