- build and test using Go 1.6
- fix
reflect+anonymous+unexported
bug ingopacket
'spacket.go
- use godep to vendor dependencies
- as Elastic Beats continues to change rapidly
- fix for gopacket
- it was based on a clone of filebeat (which is great for syslogs, but not unified2 files)
- originally, cloning filebeat was a good choice
- it is much simpler, more readable, and more appropriate for unified2 files
- the issue with excessive CPU usage (70+% on all cores) has disappeared
- followed the Beats development guide
- dependencies:
-
- gopacket -- for the
packet_dump
field
- gopacket -- for the
-
- geoip2-golang -- to geocode IP v4/6 addresses
-
- go-unified2 -- to read and spool unified2 files
- this is a fork of the original go-unified2
- with changes for the registrar feature
- this was a
git clone
of Filebeat as of 2015-11-25 with these changes:- remove line-oriented text file reading
- add unified2 file (binary) format reading via go-unified2
- index separate document
_type
's for each unified2 record: event, packet, extradata - use gopacket for:
- packet layers
- a human readable
packet_dump
that is indexed
- add geolocation for source/destination IPs via go-libGeoIP (included with libbeat)
All notable changes to this project will be documented in this file based on the Keep a Changelog Standard.