{
  "description" : "suricata.rdp",
  "processors" : [
    { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.tx_id", 		"target_field": "rdp.tx_id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.event_type", 		"target_field": "rdp.event_type",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.cookie", 		"target_field": "rdp.cookie",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.version", 		"target_field": "rdp.client_version",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.desktop_width", 		"target_field": "rdp.desktop__width",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.desktop__height", 		"target_field": "rdp.desktop__height",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.color_depth", 		"target_field": "rdp.requested_color_depth",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.keyboard_layout", 		"target_field": "rdp.keyboard_layout",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.build", 		"target_field": "rdp.client_build",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.client_name", 		"target_field": "client.name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.keyboard_type", 		"target_field": "rdp.keyboard_type",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.function_keys", 		"target_field": "rdp.function_keys",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.product_id", 		"target_field": "rdp.product_id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.capabilities", 		"target_field": "rdp.client_capabilities",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.client.id", 		"target_field": "rdp.client_id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.channels", 		"target_field": "rdp.channels",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.server_supports", 		"target_field": "rdp.server_supports",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rdp.x509_serials", 		"target_field": "rdp.x509_serials",		"ignore_missing": true 	} },


    { "pipeline": { "name": "common" } }
  ]
}