diff --git a/salt/elasticsearch/files/ingest/zeek.dns b/salt/elasticsearch/files/ingest/zeek.dns
index 050c6d414..09ce7fd9f 100644
--- a/salt/elasticsearch/files/ingest/zeek.dns
+++ b/salt/elasticsearch/files/ingest/zeek.dns
@@ -23,7 +23,7 @@
     { "rename": 	{ "field": "message2.TTLs", 		"target_field": "dns.ttls",			"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.rejected", 	"target_field": "dns.query.rejected",		"ignore_missing": true 	} },
     { "script": 	{ "lang": "painless", "source": "ctx.dns.query.length = ctx.dns.query.name.length()",	"ignore_failure": true  } },
-    { "pipeline": { "if": "ctx.dns.query.name.contains('.')", "name": "zeek.dns.tld"} },
+    { "pipeline": { "if": "ctx.dns.query?.name != null && ctx.dns.query.name.contains('.')", "name": "zeek.dns.tld" } },
     { "pipeline":       { "name": "zeek.common"											} }
   ]
 }
diff --git a/salt/elasticsearch/files/ingest/zeek.kerberos b/salt/elasticsearch/files/ingest/zeek.kerberos
index 33381cd2d..0b09ebf61 100644
--- a/salt/elasticsearch/files/ingest/zeek.kerberos
+++ b/salt/elasticsearch/files/ingest/zeek.kerberos
@@ -13,9 +13,9 @@
     { "rename": 	{ "field": "message2.cipher", 		"target_field": "kerberos.ticket.cipher",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.forwardable", 	"target_field": "kerberos.ticket.forwardable",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.renewable", 	"target_field": "kerberos.ticket.renewable",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.client_cert_subject", 	"target_field": "kerberos.client.certificate.subject",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.client_cert_subject", 	"target_field": "kerberos.client_certificate_subject",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.client_cert_fuid", 	"target_field": "log.id.client_certificate_fuid",	"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.server_cert_subject", 	"target_field": "kerberos.server.certificate.subject",	"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.server_cert_subject", 	"target_field": "kerberos.server_certificate_subject",	"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.server_cert_fuid", 	"target_field": "log.id.server_certificate_fuid",	"ignore_missing": true 	} },
     { "pipeline":       { "name": "zeek.common"                                                                                   } }
   ]