{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/711","labels_url":"https://api.github.com/repos/elastic/beats/issues/711/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/711/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/711/events","html_url":"https://github.com/elastic/beats/issues/711","id":126450560,"number":711,"title":"unsure how to contribute a new beat","user":{"login":"cleesmith","id":412807,"avatar_url":"https://avatars.githubusercontent.com/u/412807?v=3","gravatar_id":"","url":"https://api.github.com/users/cleesmith","html_url":"https://github.com/cleesmith","followers_url":"https://api.github.com/users/cleesmith/followers","following_url":"https://api.github.com/users/cleesmith/following{/other_user}","gists_url":"https://api.github.com/users/cleesmith/gists{/gist_id}","starred_url":"https://api.github.com/users/cleesmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cleesmith/subscriptions","organizations_url":"https://api.github.com/users/cleesmith/orgs","repos_url":"https://api.github.com/users/cleesmith/repos","events_url":"https://api.github.com/users/cleesmith/events{/privacy}","received_events_url":"https://api.github.com/users/cleesmith/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/beats/labels/new%20beat","name":"new beat","color":"90ee90"},{"url":"https://api.github.com/repos/elastic/beats/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2016-01-13T15:57:39Z","updated_at":"2016-01-14T23:29:11Z","closed_at":null,"body":"I have created a new beat called Unifiedbeat (for lack of a better name) at:\r\nhttps://github.com/cleesmith/unifiedbeat\r\nThis beat is useful for anyone wishing to index alert, event, and packet data from Snort/Suricata unified2 binary files ... it's really filebeat altered to handle the data in unified2 files.\r\n\r\nI tried performing a \"pull request\" as stated in the developers guide, but unsure about the exact steps involved.\r\nAny help is appreciated.\r\nThanks,\r\nChris"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/171816111","html_url":"https://github.com/elastic/beats/issues/711#issuecomment-171816111","issue_url":"https://api.github.com/repos/elastic/beats/issues/711","id":171816111,"user":{"login":"cleesmith","id":412807,"avatar_url":"https://avatars.githubusercontent.com/u/412807?v=3","gravatar_id":"","url":"https://api.github.com/users/cleesmith","html_url":"https://github.com/cleesmith","followers_url":"https://api.github.com/users/cleesmith/followers","following_url":"https://api.github.com/users/cleesmith/following{/other_user}","gists_url":"https://api.github.com/users/cleesmith/gists{/gist_id}","starred_url":"https://api.github.com/users/cleesmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cleesmith/subscriptions","organizations_url":"https://api.github.com/users/cleesmith/orgs","repos_url":"https://api.github.com/users/cleesmith/repos","events_url":"https://api.github.com/users/cleesmith/events{/privacy}","received_events_url":"https://api.github.com/users/cleesmith/received_events","type":"User","site_admin":false},"created_at":"2016-01-14T23:29:11Z","updated_at":"2016-01-14T23:29:11Z","body":"@monicasarbu  thanks, and thanks for packetbeat\r\n\r\n@urso \r\nIt would be ideal to just write the decoding stuff, however it also requires a different reader for the binary file as well as assigning the json fields (plus geolocating the IP's) for indexing into ElasticSearch.  \r\n\r\nInitially, I thought changing **Text *string** in **FileEvent** to something like **IndexableStuff interface{}** would be more flexible, and then switch on it's type via _switch f.IndexableStuff.(type) { case string: . . ._. \r\nI did this in unifiedbeat because this is what the decoder returns after reading a record ... but in general it's maybe a bad idea (not sure, but interface{} is over used).\r\n\r\nThanks you for adding unifiedbeat to the list and the description is good.\r\n\r\nWhen I see it on the list, I will let friends know about it and see how things go from there.\r\nSecuring servers is _kind of a dark corner_ in software development so I don't expect this to be all that exciting or popular. Plus there are lots of existing software with long and trusted histories, while ElasticSearch would be consider a new kid on the block. But we have used it to great success.\r\n\r\nAgain, thanks to all, and especially those who wrote filebeat and the whole beats idea."}}