From 1f9bf45b662805e0eb030893eb51f172bc779a62 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Tue, 24 Mar 2026 11:24:59 -0400
Subject: [PATCH] Lowercase network transport

---
 salt/elasticsearch/files/ingest/suricata.common | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common
index 7b2dc7eeb..887d10f86 100644
--- a/salt/elasticsearch/files/ingest/suricata.common
+++ b/salt/elasticsearch/files/ingest/suricata.common
@@ -22,6 +22,12 @@
                 "ignore_failure": true
             }
         },
+        {
+            "lowercase": {
+                "field": "network.transport",
+                "ignore_failure": true
+            }
+        },
         {
             "rename": {
                 "field": "message2.in_iface",