diff --git a/salt/elasticsearch/files/ingest/strelka b/salt/elasticsearch/files/ingest/strelka
deleted file mode 100644
index 39783c2ce..000000000
--- a/salt/elasticsearch/files/ingest/strelka
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "description" : "strelka",
-  "processors" : [
-    { "json":           { "field": "message",                        "target_field": "message2",                   "ignore_failure": true  } },
-    { "rename":         { "field": "message2.file",        "target_field": "file",          "ignore_missing": true  } },
-    { "rename":         { "field": "message2.scan",        "target_field": "scan",          "ignore_missing": true  } },
-    { "rename":         { "field": "message2.request",        "target_field": "request",          "ignore_missing": true  } },
-    { "rename":         { "field": "scan.hash",        "target_field": "file.hash",          "ignore_missing": true  } },
-    { "remove":         { "field": ["host", "path", "agent"],                                         "ignore_missing": true  } },
-    { "pipeline":       { "name": "common"                                                                                   } }
-  ]
-}
diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file
index ed80a4e5b..cf9cb48f7 100644
--- a/salt/elasticsearch/files/ingest/strelka.file
+++ b/salt/elasticsearch/files/ingest/strelka.file
@@ -7,6 +7,18 @@
     { "rename":         { "field": "message2.request",        "target_field": "request",          "ignore_missing": true  } },
     { "rename":         { "field": "scan.hash",        "target_field": "hash",          "ignore_missing": true  } },
     { "grok":           { "field": "request.attributes.filename",       "patterns": ["-%{WORD:log.id.fuid}-"] } },
+    { "foreach":
+      {
+        "if": "ctx.scan?.exiftool?.keys !=null",
+          "field": "scan.exiftool.keys",
+          "processor":{
+            "set": {
+              "field": "scan.exiftool.{{_ingest._value.key}}",
+              "value": "{{_ingest._value.value}}"
+            }
+          }
+      }
+    },
     { "remove":         { "field": ["host", "path"],                                         "ignore_missing": true  } },
     { "pipeline":       { "name": "common"                                                                                   } }
   ]