diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert
new file mode 100644
index 000000000..2f2bb1196
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_client_software_cert
@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.opcua.activate_session_client_software_cert",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                  "ignore_failure": true } },
+    { "json":     { "field": "message",			               "target_field": "message2",		        "ignore_failure": true} },
+    { "rename":   { "field": "message2.client_software_cert_link_id",                 "target_field": "opcua.client_software_cert.link_id",                 "ignore_missing": true } },
+    { "rename":   { "field": "message2.cert_data", "target_field": "opcua.certificate.data",         "ignore_missing": true } },
+    { "rename":   { "field": "message2.cert_signature", "target_field": "opcua.certificate.signature",           "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info
new file mode 100644
index 000000000..86c4b5eb7
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_diagnostic_info
@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua.activate_session_diagnostic_info",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                  "ignore_failure": true } },
+    { "json":     { "field": "message",			               "target_field": "message2",		        "ignore_failure": true} },
+    { "rename":   { "field": "message2.activate_session_diag_info_link_id",                 "target_field": "opcua.activate_session_diag_info.link_id",                 "ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id", "target_field": "opcua.diag_info.link_id",         "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id
new file mode 100644
index 000000000..42674c864
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_activate_session_locale_id
@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.opcua.activate_session_locale_id",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                  "ignore_failure": true } },
+    { "json":     { "field": "message",			               "target_field": "message2",		        "ignore_failure": true} },
+    { "rename":   { "field": "message2.opcua_locale_link_id",                 "target_field": "opcua.locale.link_id",                 "ignore_missing": true } },
+    { "rename":   { "field": "message2.local_id", "target_field": "opcua.local_id",         "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}