diff --git a/salt/elasticsearch/files/ingest/suricata.flow b/salt/elasticsearch/files/ingest/suricata.flow
index c51961c05..47bec3a60 100644
--- a/salt/elasticsearch/files/ingest/suricata.flow
+++ b/salt/elasticsearch/files/ingest/suricata.flow
@@ -4,6 +4,11 @@
     { "set":      { "field": "dataset",        "value": "conn"  } },
     { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
     { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.flow.state", 		"target_field": "connection.state",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.flow.bytes_toclient", 		"target_field": "server.ip_bytes",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.flow.bytes_toserver", 		"target_field": "client.ip_bytes",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.flow.start", 		"target_field": "connection.start",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.flow.end", 		"target_field": "connection.end",		"ignore_missing": true 	} },
     { "pipeline": { "name": "common" } }
   ]
 }