filter {
  if [engine] == "suricata" {
      json {
        source => "message"
      }
      mutate {
      # Make this compatible with event.id as a string
      convert => { "[flow_id]" => "string" }
      rename => {
        "proto" => "[network][transport]"
        "event_type" => "[event][dataset]"
        "flow_id" => "[event][id]"
        "community_id" => "[network][community_id]"
      }
      lowercase => [ "[network][transport]" ]
      merge => {"[event][id]" => "[related][id]" }
      add_field => {
        "[related][domain]" => []
        "[related][ip]" => []
        "[related][id]" => []
        "[event][module]" => "suricata"
        "[event][created]" => "%{[@timestamp]}"
        "[event][version]" => "1.0.0"
        "[event][category]" => "network"
      }
    }

    # Set the timestamp from the event
    date {
      match => [ "timestamp", "ISO8601" ]
      tag_on_failure => [ "_dateparsefailure", "_parsefailure", "_suricata_dateparsefailure" ]
      remove_field => [ "timestamp" ]
    }

    # Suricata uses top-level src/dest to track flow
    if [src_ip] {
      mutate {
        rename => {
          "[src_ip]" => "[source][ip]"
          "[src_port]" => "[source][port]"
        }
        merge => { "[related][ip]" => "[source][ip]" }
      }
    }
    if [dest_ip] {
      mutate {
        rename => {
          "[dest_ip]" => "[destination][ip]"
          "[dest_port]" => "[destination][port]"
        }
        merge => { "[related][ip]" => "[destination][ip]" }
      }
    }

    if [vlan] {
      mutate {
        rename => { "[vlan]" => "[vlan][id]" }
      }
    }
    if [app_proto] {
      if [app_proto] == "failed" {
        # delete failed detections to be consistent with zeek
        mutate { rename => { "app_proto" => "[error][message]" } }
      }
      else {
        mutate { rename => {"app_proto" => "[network][protocol]"}}
      }
    }
    if [event_type] == "alert" {
      if [alert][severity] == 1 {
        mutate {
          add_field => { "severity" => "High" }
        }
      }
      if [alert][severity] == 2 {
        mutate {
          add_field => { "severity" => "Medium" }
        }
      }
      if [alert][severity] == 3 {
        mutate {
          add_field => { "severity" => "Low" }
        }
      }
          # If the alert is a Snort GPL alert break it apart for easier reading and categorization
      if [alert][signature] =~ "GPL " {
            # This will parse out the category type from the alert
        grok {
          match => { "[alert][signature]" => "GPL\s+%{DATA:category}\s" }
        }
                # This will store the category
        mutate {
          add_field => { "rule_type" => "Snort GPL" }
          lowercase => [ "category" ]
        }
      }
          # If the alert is an Emerging Threat alert break it apart for easier reading and categorization
      if [alert][signature] =~ "ET " {
            # This will parse out the category type from the alert
        grok {
          match => { "[alert][signature]" => "ET\s+%{DATA:category}\s" }
        }
                # This will store the category
        mutate {
          add_field => { "rule_type" => "Emerging Threats" }
          lowercase => [ "category" ]
        }
      }
          # This section adds URLs to lookup information about a rule online
      if [rule_type] == "Snort GPL" {
        mutate {
          add_field => [ "signature_info", "https://www.snort.org/search?query=%{[alert][gid]}-%{[alert][signature_id]}" ]
        }
      }
      if [rule_type] == "Emerging Threats" {
        mutate {
          add_field => [ "signature_info", "http://doc.emergingthreats.net/%{[alert][signature_id]}" ]
        }
      }
    }
    mutate {
      remove_field => [ "alert" ]
    }
  }
}
