{
  "description" : "suricata.krb5",
  "processors" : [
    { "set":      { "field": "dataset",        "value": "kerberos"  } },
    { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
    { "rename":         { "field": "message2.krb5.msg_type",                "target_field": "kerberos.request_type",             "ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.cname",                "target_field": "kerberos.client",             "ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.realm",                "target_field": "kerberos.realm",             "ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.sname",                "target_field": "kerberos.service",             "ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.encryption",                "target_field": "kerberos.ticket.cipher",             "ignore_missing": true  } },
    { "rename":         { "field": "message2.krb.weak_encryption",                "target_field": "kerberos.weak_encryption",             "ignore_missing": true  } },
    { "pipeline": { "name": "common" } }
  ]
}