{
  "description" : "zeek.s7comm_upload_download",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "s7comm_upload_download" } },
    { "remove":   { "field": ["host"],									"ignore_failure": true } },
    { "json":     { "field": "message",				"target_field": "message2",		"ignore_failure": true } },
    { "rename":   { "field": "message2.rosctr",                 "target_field": "s7.ros.control.name",  "ignore_missing": true } },
    { "rename":   { "field": "message2.pdu_reference",		"target_field": "s7.pdu_reference",	"ignore_missing": true } },
    { "rename":   { "field": "message2.function_code",		"target_field": "s7.function_code",	"ignore_missing": true } },
    { "rename":   { "field": "message2.function_status",        "target_field": "s7.function_status",   "ignore_missing": true } },
    { "rename":   { "field": "message2.session_id",             "target_field": "s7.session_id",        "ignore_missing": true } },
    { "rename":   { "field": "message2.blocklength",            "target_field": "s7.block.length",      "ignore_missing": true } },
    { "rename":   { "field": "message2.filename",               "target_field": "s7.file.name",         "ignore_missing": true } },
    { "rename":   { "field": "message2.block_type",             "target_field": "s7.block.type",        "ignore_missing": true } },
    { "rename":   { "field": "message2.block_number",           "target_field": "s7.block.number",      "ignore_missing": true } },
    { "rename":   { "field": "message2.destination_filesystem", "target_field": "s7.destination.filesystem", "ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}
