Some files in the repository are missing newlines at the very end, as pointed out by @nrbrook in #1026

Classes/CocoaLumberjack.h was specifically mentioned, but there could be other files that are missing this as well.

These configs are part of the "adding Logstash to filebeat modules getting started experience" and therefore its very likely the first time a user will see a LS config.

For the best experience we should add a fair few comments to better inform what is going on. The user sees the nested field reference for the first time and there is a try three grok pattern scheme with two mutate renames that w

Describe the bug
Distributor tests fail when the test system does not have any network interfaces named eth0, en0, or lo0.

To Reproduce
make test on a system without any interfaces named eth0, en0, or lo0.

Expected behavior
make test should pass.

Environment:

• Debian buster
• Golang 1.13.6-2~bpo10+1

Screenshots, Promtail config, or terminal output

Someone should map publicly available EVTX samples to Sigma rules. This would enable us to automatically test the correctness of generated queries.

Known security-related EVTX repositories:

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
• https://github.com/Cyb3rWard0g/mordor

Feel free to extend the list.

Mapping should be:

Sigma rule -> Repository/EVTX ( -> expected matched