{"action":"opened","issue":{"url":"https://api.github.com/repos/cleesmith/unifiedbeat/issues/10","repository_url":"https://api.github.com/repos/cleesmith/unifiedbeat","labels_url":"https://api.github.com/repos/cleesmith/unifiedbeat/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/cleesmith/unifiedbeat/issues/10/comments","events_url":"https://api.github.com/repos/cleesmith/unifiedbeat/issues/10/events","html_url":"https://github.com/cleesmith/unifiedbeat/issues/10","id":167667460,"number":10,"title":"unexpected error: 'unexpected EOF'","user":{"login":"urvile","id":18539501,"avatar_url":"https://avatars.githubusercontent.com/u/18539501?v=3","gravatar_id":"","url":"https://api.github.com/users/urvile","html_url":"https://github.com/urvile","followers_url":"https://api.github.com/users/urvile/followers","following_url":"https://api.github.com/users/urvile/following{/other_user}","gists_url":"https://api.github.com/users/urvile/gists{/gist_id}","starred_url":"https://api.github.com/users/urvile/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/urvile/subscriptions","organizations_url":"https://api.github.com/users/urvile/orgs","repos_url":"https://api.github.com/users/urvile/repos","events_url":"https://api.github.com/users/urvile/events{/privacy}","received_events_url":"https://api.github.com/users/urvile/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-26T17:39:43Z","updated_at":"2016-07-26T17:39:43Z","closed_at":null,"body":"`2016-07-26T17:22:41Z INFO Setup: Rules warnings: 0 multiple line rules rejected, 0 duplicate rules rejected\r\n2016-07-26T17:22:41Z INFO Setup: Rules stats: 154 rule files read, 9511 rules created\r\n2016-07-26T17:22:41Z INFO Setup: registrar: registry file: \"/etc/unifiedbeat/.unifiedbeat\"\r\n2016-07-26T17:22:41Z INFO Setup: registrar: file source: \"/var/log/snort/merged.log\"\r\n2016-07-26T17:22:41Z INFO Setup: registrar: file offset: 1271\r\n2016-07-26T17:22:41Z INFO unifiedbeat sucessfully setup. Start running.\r\n2016-07-26T17:22:41Z INFO Run: start spooling and publishing...\r\n2016-07-26T17:22:41Z INFO U2SpoolAndPublish: spooling and publishing...\r\n2016-07-26T17:22:41Z CRIT U2SpoolAndPublish: unexpected error: 'unexpected EOF'\r\n2016-07-26T17:22:41Z INFO Run: updated registry file.\r\n2016-07-26T17:22:41Z INFO Start exiting beat\r\n2016-07-26T17:22:41Z INFO Stopping Beat\r\n2016-07-26T17:22:41Z INFO Stop: is spooling and publishing running? 'false'\r\n2016-07-26T17:22:41Z INFO Stop: done after waiting 99.03µs.\r\n2016-07-26T17:22:41Z INFO Cleaning up unifiedbeat before shutting down.\r\n2016-07-26T17:22:41Z INFO Cleanup: is spooling and publishing running? 'false'\r\n2016-07-26T17:22:41Z INFO Cleanup: closed GeoIp2Reader.\r\n2016-07-26T17:22:41Z INFO Cleanup: done.\r\n2016-07-26T17:22:41Z INFO Exit beat completed\r\n`\r\nI think this is the only pertinent line in the snort.conf \r\n`#/etc/snort.conf\r\noutput log_unified2: filename snort.log, limit 128, nostamp\r\n`\r\n\r\n`#/etc/unifiedbeat/unifiedbeat.yaml\r\nsensor:\r\n  unified2_path: \"/var/log/snort/\"\r\n  unified2_prefix: \"merged.log\"\r\n  geoip2_path: \"/etc/unifiedbeat/GeoLite2-City.mmdb\"\r\n  rules:\r\n    gen_msg_map_path: \"/etc/snort/gen-msg.map\"\r\n    paths:\r\n      - \"/etc/snort/rules/*.rules\"\r\n      - \"/etc/snort/preproc_fules/*.rules\"\r\n      - \"/etc/snort/so_rules/*.rules\"\r\n  fields:\r\n    sensor_hostname: console02-aip.prod.sweetlabs.com\r\n    sensor_interface: eth0\r\n    sensor_type: snort\r\n  fields_under_root: true\r\noutput:\r\n  logstash:\r\n    hosts: [\"logstash.prod.sweetlabs.com:5045\"]\r\n    index: unifiedbeat\r\n    tls:\r\n      # List of root certificates for HTTPS server verifications\r\n      certificate_authorities: [\"/etc/logstash-forwarder/logstash-forwarder.crt\"]\r\n\r\n      # Certificate for TLS client authentication\r\n      certificate: \"/etc/logstash-forwarder/logstash-forwarder.crt\"\r\n\r\n      # Client Certificate Key\r\n      certificate_key: \"/etc/logstash-forwarder/logstash-forwarder.key\"\r\n\r\n      # Controls whether the client verifies server certificates and host name.\r\n      # If insecure is set to true, all server host names and certificates will be\r\n      # accepted. In this mode TLS based connections are susceptible to\r\n      # man-in-the-middle attacks. Use only for testing.\r\n      #insecure: true\r\n\r\n      # Configure cipher suites to be used for TLS connections\r\n      #cipher_suites: []\r\n\r\n      # Configure curve types for ECDHE based cipher suites\r\n      #curve_types: []\r\n\r\n\r\n\r\n  file:\r\n    path: \"/var/log/unifiedbeat/u2\"\r\nconsole:\r\n  pretty: true\r\nshipper:\r\n  name: console02-aip.prod.sweetlabs.com\r\n  geoip:\r\n    paths:\r\n      - \"/etc/unifiedbeat/GeoLite2-City.mmdb\"\r\n\r\n\r\n\r\n\r\n\r\nlogging:\r\n  to_files: true\r\n  files:\r\n    path: /var/log/unifiedbeat\r\n    name: unifiedbeat\r\n    rotateeverybytes: 10485760 # = 10MB\r\n    keepfiles: 3\r\n  level: debug \r\n\r\n`\r\n\r\n`\r\n2016-07-26T17:22:34Z DBG  Disable stderr logging\r\n2016-07-26T17:22:34Z DBG  Initializing output plugins\r\n2016-07-26T17:22:34Z INFO Loaded GeoIP data from: /etc/unifiedbeat/GeoLite2-City.mmdb\r\n2016-07-26T17:22:34Z INFO Max Retries set to: 3\r\n2016-07-26T17:22:34Z DBG  connect\r\n2016-07-26T17:22:34Z INFO Activated logstash as output plugin.\r\n2016-07-26T17:22:34Z INFO File output base filename set to: unifiedbeat\r\n2016-07-26T17:22:34Z INFO Rotate every bytes set to: 10485760\r\n2016-07-26T17:22:34Z INFO Number of files set to: 7\r\n2016-07-26T17:22:34Z INFO Activated file as output plugin.\r\n2016-07-26T17:22:34Z DBG  Create output worker\r\n2016-07-26T17:22:34Z DBG  Create output worker\r\n2016-07-26T17:22:34Z DBG  No output is defined to store the topology. The server fields might not be filled.\r\n2016-07-26T17:22:34Z INFO Publisher name: console02-aip.prod.sweetlabs.com\r\n2016-07-26T17:22:34Z INFO Flush Interval set to: 1s\r\n2016-07-26T17:22:34Z INFO Max Bulk Size set to: 2048\r\n2016-07-26T17:22:34Z DBG  create bulk processing worker (interval=1s, bulk size=2048)\r\n2016-07-26T17:22:34Z INFO Flush Interval set to: -1ms\r\n2016-07-26T17:22:34Z INFO Max Bulk Size set to: -1\r\n2016-07-26T17:22:34Z INFO Init Beat: unifiedbeat; Version: 2.0.1\r\n2016-07-26T17:22:34Z INFO Setup: activated 'GeoIP2' database for IP v4 and v6 geolocating.\r\n2016-07-26T17:22:34Z DBG  processing matched file: /etc/snort/rules/app-detect.rules\r\n<snip>\r\n 2016-07-26T17:22:34Z DBG  processing matched file: /etc/snort/so_rules/server-webapp.rules\r\n2016-07-26T17:22:41Z INFO Setup: Rules warnings: 0 multiple line rules rejected, 0 duplicate rules rejected\r\n2016-07-26T17:22:41Z INFO Setup: Rules stats: 154 rule files read, 9511 rules created\r\n2016-07-26T17:22:41Z INFO Setup: registrar: registry file: \"/etc/unifiedbeat/.unifiedbeat\"\r\n2016-07-26T17:22:41Z INFO Setup: registrar: file source: \"/var/log/snort/merged.log\"\r\n2016-07-26T17:22:41Z INFO Setup: registrar: file offset: 1271\r\n2016-07-26T17:22:41Z INFO unifiedbeat sucessfully setup. Start running.\r\n2016-07-26T17:22:41Z INFO Run: start spooling and publishing...\r\n2016-07-26T17:22:41Z INFO U2SpoolAndPublish: spooling and publishing...\r\n2016-07-26T17:22:41Z CRIT U2SpoolAndPublish: unexpected error: 'unexpected EOF'\r\n2016-07-26T17:22:41Z INFO Run: updated registry file.\r\n2016-07-26T17:22:41Z INFO Start exiting beat\r\n2016-07-26T17:22:41Z INFO Stopping Beat\r\n2016-07-26T17:22:41Z INFO Stop: is spooling and publishing running? 'false'\r\n2016-07-26T17:22:41Z INFO Stop: done after waiting 99.03µs.\r\n2016-07-26T17:22:41Z INFO Cleaning up unifiedbeat before shutting down.\r\n2016-07-26T17:22:41Z INFO Cleanup: is spooling and publishing running? 'false'\r\n2016-07-26T17:22:41Z INFO Cleanup: closed GeoIp2Reader.\r\n2016-07-26T17:22:41Z INFO Cleanup: done.\r\n2016-07-26T17:22:41Z INFO Exit beat completed\r\n`\r\n\r\n"}}
{"actor":{"display_login":"urvile"}}