Some files in the repository are missing newlines at the very end, as pointed out by @nrbrook in #1026

Classes/CocoaLumberjack.h was specifically mentioned, but there could be other files that are missing this as well.

These configs are part of the "adding Logstash to filebeat modules getting started experience" and therefore its very likely the first time a user will see a LS config.

For the best experience we should add a fair few comments to better inform what is going on. The user sees the nested field reference for the first time and there is a try three grok pattern scheme with two mutate renames that w

Is your feature request related to a problem? Please describe.
With the yaml based config and options inherited from cortex etc its easy to make mistakes in the loki config file that don't manifest until runtime. Right now the only way to test the config, per the team on Slack, is to run loki on it. This is fine for a manual check but it becomes difficult to work with in CI environments.

Someone should map publicly available EVTX samples to Sigma rules. This would enable us to automatically test the correctness of generated queries.

Known security-related EVTX repositories:

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
• https://github.com/Cyb3rWard0g/mordor

Feel free to extend the list.

Mapping should be:

Sigma rule -> Repository/EVTX ( -> expected matched