# two issues with the intel framework **URL:** \ **Category:** Zeek\ **Created:** [November 23, 2013, 1:26am UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913 "2013-11-23T01:26:50Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)\ **Post date:** [November 23, 2013, 1:26am UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/1 "2013-11-23T01:26:50Z")
I followed the examples step by step and I cannot get bro to like the text file or dat file from the documentation. I get errors in the reporter.log about not being able to find the requested field indicator. The other error is "headers are incorrect". Any help would be appreciated. Thanks! ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 23, 2013, 2:05am UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/2 "2013-11-23T02:05:21Z")
It's helpful to post exactly why errors you're seeing and exactly how you're configuring and running Bro (i.e., send the exact errors and send an example of something you can provide Bro to reproduce the error. Thanks,   .Seth ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [November 23, 2013, 2:14am UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/3 "2013-11-23T02:14:56Z")
Also - check if the header fields are separated by tab characters and not by spaces. That might be the problem. Johanna ---
**Author:** ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)\ **Post date:** [November 23, 2013, 1:32pm UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/4 "2013-11-23T13:32:16Z")
Reporter.log #separator \x09 #set\_separator , #empty\_field (empty) #unset\_field - #path reporter #open 2013-11-23-08-28-18 #fields ts level message location #types time enum string string 1385213298.936827 Reporter::ERROR /etc/bro/spool/installed-scripts-do-not-touch/site/intel1.txt/Input::READER\_ASCII: Did not find requested field indicator in input data file /etc/bro/spool$ 1385213298.936827 Reporter::ERROR /etc/bro/spool/installed-scripts-do-not-touch/site/intel1.txt/Input::READER\_ASCII: Init: cannot open /etc/bro/spool/installed-scripts-do-not-touch/site/int$ 1385213298.936827 Reporter::ERROR /etc/bro/spool/installed-scripts-do-not-touch/site/intel1.txt/Input::READER\_ASCII: Init failed (empty) 1385213298.936827 Reporter::ERROR /etc/bro/spool/installed-scripts-do-not-touch/site/intel1.txt/Input::READER\_ASCII: terminating thread (empty) /etc/bro/share/bro/site/intel.txt #fields indicator indicator\_type meta.source [instagram.com](http://instagram.com) Intel::DOMAIN my\_special\_source local.bro @load intel1.bro intel1.bro @load frameworks/intel/seen redef Intel::read\_files += {         fmt("%s/intel1.txt", @DIR) }; ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [November 23, 2013, 3:50pm UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/5 "2013-11-23T15:50:55Z")
Just to check - are you a hundred percent sure that the first line of your intel.txt file looks like… #fields[tab]indicator[tab]indicator\_type[tab]mata.source Without any other characters in between, especially not using spaces instead of tab? > From the paste in your mail we are unable to tell if that is the case, but the error message really sounds like there is some kind of problem with that line in the input file. Johanna ---
**Author:** ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1)\ **Post date:** [November 23, 2013, 7:01pm UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/6 "2013-11-23T19:01:05Z")
You guys had it. I went back in and redid the entire line with just tabs. I believe I had it this way but just to be certain I redid the entire file. Something must have through it off or was lingering in the original file. You guys are the best! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/two-issues-with-the-intel-framework/2913/7 "2022-05-06T15:41:24Z")