From 4b39ccec6d6f05590a5fda2817ab868de8f54fc4 Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Thu, 3 Nov 2022 15:30:20 -0700 Subject: [PATCH] Update zeek.bacnet_property --- .../elasticsearch/files/ingest/zeek.bacnet_property | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_property b/salt/elasticsearch/files/ingest/zeek.bacnet_property index 09ea3dae2..9a39ae5a0 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_property +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_property @@ -2,10 +2,15 @@ "description" : "zeek.bacnet_property", "processors" : [ { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, - { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, - { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.property", "target_field": "bacnet.property", "ignore_missing": true } }, + { "rename": { "field": "message2.array_index", "target_field": "bacnet.array.index", "ignore_missing": true } }, + { "rename": { "field": "message2.value", "target_field": "bacnet.value", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] }