2020-08-14T07:24:08.843+1000 INFO [beat] instance/beat.go:1028 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read"],"ambient":null}, "cwd": "/home/jromero", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 15072, "ppid": 15042, "seccomp": {"mode":"filter"}, "start_time": "2020-08-14T07:24:07.870+1000"}}}
2020-08-14T07:24:08.843+1000 INFO instance/beat.go:310 Setup Beat: filebeat; Version: 7.8.1
2020-08-14T07:24:08.843+1000 DEBUG [beat] instance/beat.go:336 Initializing output plugins
2020-08-14T07:24:08.845+1000 DEBUG [publisher] pipeline/consumer.go:137 start pipeline event consumer
2020-08-14T07:24:08.845+1000 INFO [publisher] pipeline/module.go:113 Beat name: jumphost
2020-08-14T07:24:08.847+1000 WARN beater/filebeat.go:156 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-08-14T07:24:08.847+1000 INFO instance/beat.go:463 filebeat start running.
2020-08-14T07:24:08.847+1000 DEBUG [test] registrar/migrate.go:159 isFile(/var/lib/filebeat/registry) -> false
2020-08-14T07:24:08.847+1000 DEBUG [test] registrar/migrate.go:159 isFile() -> false
2020-08-14T07:24:08.848+1000 DEBUG [test] registrar/migrate.go:152 isDir(/var/lib/filebeat/registry/filebeat) -> true
2020-08-14T07:24:08.848+1000 DEBUG [test] registrar/migrate.go:159 isFile(/var/lib/filebeat/registry/filebeat/meta.json) -> true
2020-08-14T07:24:08.848+1000 DEBUG [registrar] registrar/migrate.go:51 Registry type '0' found
2020-08-14T07:24:08.848+1000 DEBUG [registrar] registrar/registrar.go:125 Registry file set to: /var/lib/filebeat/registry/filebeat/data.json
2020-08-14T07:24:08.848+1000 WARN beater/filebeat.go:339 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-08-14T07:24:08.848+1000 INFO registrar/registrar.go:145 Loading registrar data from /var/lib/filebeat/registry/filebeat/data.json
2020-08-14T07:24:08.848+1000 INFO registrar/registrar.go:152 States Loaded from registrar: 0
2020-08-14T07:24:08.848+1000 INFO [crawler] beater/crawler.go:71 Loading Inputs: 1
2020-08-14T07:24:08.848+1000 INFO [google.pubsub] googlepubsub/input.go:112 Initialized Google Pub/Sub input. {"pubsub_project": "redacted", "pubsub_topic": "vpc-firewall-logs-topic", "pubsub_subscription": {"Name":"filebeat-vpc-firewall-logs-sub","NumGoroutines":1,"MaxOutstandingMessages":1000,"Create":false}}
2020-08-14T07:24:08.848+1000 INFO [crawler] beater/crawler.go:141 Starting input (ID: 11448794657429154599)
2020-08-14T07:24:08.848+1000 DEBUG [cfgfile] cfgfile/reload.go:132 Checking module configs from: /etc/filebeat/modules.d/*.yml
2020-08-14T07:24:08.849+1000 DEBUG [cfgfile] cfgfile/cfgfile.go:193 Load config from file: /etc/filebeat/modules.d/googlecloud.yml
2020-08-14T07:24:08.849+1000 DEBUG [cfgfile] cfgfile/reload.go:146 Number of module configs found: 1
2020-08-14T07:24:08.857+1000 DEBUG [processor.javascript] javascript/session.go:162 Registered params with processor
2020-08-14T07:24:08.858+1000 DEBUG [processors] processors/processor.go:101 Generated new processors: script=[type=javascript, id=, sources=/usr/share/filebeat/module/googlecloud/firewall/config/pipeline.js], add_fields={"ecs":{"version":"1.5.0"}}
2020-08-14T07:24:08.858+1000 INFO [google.pubsub] googlepubsub/input.go:112 Initialized Google Pub/Sub input. {"pubsub_project": "redacted", "pubsub_topic": "projects/redacted/topics/vpc-firewall-logs-topic", "pubsub_subscription": {"Name":"projects/redacted/subscriptions/filebeat-vpc-firewall-logs-sub","NumGoroutines":1,"MaxOutstandingMessages":1000,"Create":true}}
2020-08-14T07:24:08.858+1000 INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 1
2020-08-14T07:24:08.859+1000 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2020-08-14T07:24:08.859+1000 DEBUG [registrar] registrar/registrar.go:278 Starting Registrar
2020-08-14T07:24:08.859+1000 INFO [google.pubsub] googlepubsub/input.go:122 Pub/Sub input worker has started. {"pubsub_project": "redacted", "pubsub_topic": "vpc-firewall-logs-topic", "pubsub_subscription": {"Name":"filebeat-vpc-firewall-logs-sub","NumGoroutines":1,"MaxOutstandingMessages":1000,"Create":false}}
2020-08-14T07:24:08.859+1000 ERROR [google.pubsub] googlepubsub/input.go:127 pubsub: invalid character '\n' in string literal {"pubsub_project": "redacted", "pubsub_topic": "vpc-firewall-logs-topic", "pubsub_subscription": {"Name":"filebeat-vpc-firewall-logs-sub","NumGoroutines":1,"MaxOutstandingMessages":1000,"Create":false}}
2020-08-14T07:24:08.859+1000 INFO [google.pubsub] googlepubsub/input.go:128 Pub/Sub input worker has stopped. {"pubsub_project": "redacted", "pubsub_topic": "vpc-firewall-logs-topic", "pubsub_subscription": {"Name":"filebeat-vpc-firewall-logs-sub","NumGoroutines":1,"MaxOutstandingMessages":1000,"Create":false}}
2020-08-14T07:24:08.859+1000 INFO cfgfile/reload.go:164 Config reloader started
2020-08-14T07:24:08.860+1000 DEBUG [cfgfile] cfgfile/reload.go:194 Scan for new config files
2020-08-14T07:24:08.860+1000 DEBUG [cfgfile] cfgfile/cfgfile.go:193 Load config from file: /etc/filebeat/modules.d/googlecloud.yml
2020-08-14T07:24:08.861+1000 DEBUG [cfgfile] cfgfile/reload.go:213 Number of module configs found: 1
2020-08-14T07:24:08.862+1000 DEBUG [reload] cfgfile/list.go:62 Starting reload procedure, current runners: 0
2020-08-14T07:24:08.862+1000 DEBUG [reload] cfgfile/list.go:80 Start list: 1, Stop list: 0
2020-08-14T07:24:08.870+1000 DEBUG [processor.javascript] javascript/session.go:162 Registered params with processor