# Warning of "did not find requested field indicator" from intelligence data file **URL:** \ **Category:** Zeek\ **Created:** [August 27, 2018, 8:10am UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429 "2018-08-27T08:10:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![wangdj](https://avatars.discourse-cdn.com/v4/letter/w/e19b73/32.png) [@wangdj](https://community.zeek.org/u/wangdj)\ **Post date:** [August 27, 2018, 8:10am UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/1 "2018-08-27T08:10:50Z")
Hi, According to instruction of intelligence framework, i wrote a intelligence framework text file myintel.txt which content is: _#fields indicator indicator\_type meta.source meta.desc meta.url_ _14.215.177.39 Intel::ADDR baidu use baidu search -_ Very simple. I also wrote a simple bro script file mytest.bro which content is: _@load policy/frameworks/intel/seen_ _@load policy/frameworks/intel/do\_notice_ _redef Intel::read\_files += { “./myintel.txt” };_ when i run this script with command “./bro -i eth3 mytest” on a shell terminal and run “ping 14.215.177.39” command on another shell terminal, i got the following warning and : warning: ./myintel.txt/Input::READER\_ASCII: Did not find requested field indicator in input data file ./myintel.txt. It seems that there is no error with the myintel.txt file, then what happened leads to this warning. Best Regards ---
**Author:** ![Jan](https://avatars.discourse-cdn.com/v4/letter/j/ce7236/32.png) [@Jan](https://community.zeek.org/u/Jan)\ **Post date:** [August 28, 2018, 9:01am UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/2 "2018-08-28T09:01:42Z")
On 27/08/18 10:10, wangdj@ffcs.cn wrote:\> when i run this script with command "./bro -i eth3 mytest" on a shell terminal and run "ping 14.215.177.39" command on another shell terminal, i got the following warning and : > warning: ./myintel.txt/Input::READER\_ASCII: Did not find requested field indicator in input data file ./myintel.txt. Keep in mind that the header has to be tab-separated. Furthermore, the default seen scripts report only IPs of established TCP connections (see [https://github.com/bro/bro/blob/master/scripts/policy/frameworks/intel/seen/conn-established.bro](https://github.com/bro/bro/blob/master/scripts/policy/frameworks/intel/seen/conn-established.bro)). Jan ---
**Author:** ![wangdj](https://avatars.discourse-cdn.com/v4/letter/w/e19b73/32.png) [@wangdj](https://community.zeek.org/u/wangdj)\ **Post date:** [September 3, 2018, 9:56am UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/3 "2018-09-03T09:56:49Z")
Hi Jan, Thanks for your reply. The header in myintel.txt file is tab-separated. I will check the the second reason you told. Best Regards ---
**Author:** ![wangdj](https://avatars.discourse-cdn.com/v4/letter/w/e19b73/32.png) [@wangdj](https://community.zeek.org/u/wangdj)\ **Post date:** [September 21, 2018, 12:38pm UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/4 "2018-09-21T12:38:25Z")
Hi, When i read the document of “Bro Cluster Architecture”(link: [https://www.bro.org/sphinx/cluster/index.html)](https://www.bro.org/sphinx/cluster/index.html)) , i cannot understand the following sentence. “The packets can then be passed directly to a monitoring host where each worker has a BPF filter to limit its visibility to only that stream of flows, or onward to a commodity switch to split the traffic out to multiple 1G interfaces for the workers.” Does this sentence means worker`s BPF filter can retransmit packets to other switch? If it can not, what the above-mentioned sentence means? If it can, then what this following sentence which is also from “Bro Cluster Architecture” means? “The frontend is a discrete hardware device or on-host technique that splits traffic into many streams or flows. The Bro binary does not do this job” ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [September 23, 2018, 8:55pm UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/5 "2018-09-23T20:55:16Z")
> "The packets can then be passed directly to a monitoring host where > each worker has a BPF filter to limit its visibility to only that stream > of flows, or onward to a commodity switch to split the traffic out to > multiple 1G interfaces for the workers." > > Does this sentence means worker`s BPF filter can retransmit packets to other switch? The "or onward" part is talking about what the front-end does, rather than what the workers do. The front end \*either\* sends all packets to a host for which each individual worker applies a (disjoint) BPF filter to the stream to pick out those flows specifically for it; \*or\* the front end can send the traffic to a switch that explicitly load-balances the traffic across multiple 1G interfaces.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/warning-of-did-not-find-requested-field-indicator-from-intelligence-data-file/5429/6 "2022-05-06T15:46:00Z")