From 02821b97ad63033c6714ae6c3fd600a7aa50f7ac Mon Sep 17 00:00:00 2001 From: doug Date: Tue, 29 Nov 2022 07:26:11 -0500 Subject: [PATCH] update bacnet parsers --- salt/elasticsearch/files/ingest/zeek.bacnet | 16 +++++++------- .../files/ingest/zeek.bacnet_discovery | 21 +++++++++---------- .../files/ingest/zeek.bacnet_property | 19 ++++++++--------- 3 files changed, 27 insertions(+), 29 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet b/salt/elasticsearch/files/ingest/zeek.bacnet index d4484aa4a..c3f1582e3 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet +++ b/salt/elasticsearch/files/ingest/zeek.bacnet @@ -1,14 +1,14 @@ { "description" : "zeek.bacnet", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.bvlc_function", "target_field": "bacnet.bclv.function", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_type", "target_field": "bacnet.pdu.type", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.invoke_id", "target_field": "bacnet.invoke.id", "ignore_missing": true } }, - { "rename": { "field": "message2.result_code", "target_field": "bacnet.result.code", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.bvlc_function", "target_field": "bacnet.bclv.function", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_type", "target_field": "bacnet.pdu.type", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.invoke_id", "target_field": "bacnet.invoke.id", "ignore_missing": true } }, + { "rename": { "field": "message2.result_code", "target_field": "bacnet.result.code", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery index a2b155bf1..149a3b3d9 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery @@ -1,16 +1,15 @@ { "description" : "zeek.bacnet_discovery", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, - { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, - { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, + { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, + { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] } diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_property b/salt/elasticsearch/files/ingest/zeek.bacnet_property index 9a39ae5a0..b58c54c86 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_property +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_property @@ -1,16 +1,15 @@ { "description" : "zeek.bacnet_property", "processors" : [ - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, - { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, - { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, - { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, - { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, - { "pipeline": { "name": "zeek.common" } } + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, + { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, + { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } ] }