{
  "description" : "suricata.tls",
  "processors" : [
    { "set":      	{ "field": "event.dataset",			"value": "ssl"  								} },
    { "rename": 	{ "field": "message2.proto", 			"target_field": "network.transport",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",			"ignore_missing": true 	} },
    { "rename":         { "field": "message2.tls.subject",              "target_field": "ssl.certificate.subject",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.serial",               "target_field": "ssl.certificate.serial",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.fingerprint",          "target_field": "ssl.certificate.fingerprint",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.version",              "target_field": "ssl.version",				"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.ja3.hash",             "target_field": "hash.ja3",				"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.ja3.hash.string",      "target_field": "hash.ja3_string",			"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.ja3s.hash",            "target_field": "hash.ja3s",				"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.ja3s.hash.string",     "target_field": "hash.ja3s_string",			"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.notbefore",            "target_field": "x509.certificate.not_valid_before",	"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.notafter",             "target_field": "x509.certificate.not_valid_after",	"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.sni",			"target_field": "ssl.server_name",			"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.issuerdn",		"target_field": "ssl.certificate.issuer",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.tls.session_resumed",	"target_field": "ssl.session_resumed",			"ignore_missing": true  } },
    { "pipeline": { "name": "common" } }
  ]
}
