From 5ebf470a86a1645e07c7cdd1eba3db4ceae562dd Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Thu, 3 Nov 2022 22:27:04 -0700 Subject: [PATCH] Update zeek.bacnet_discovery --- .../files/ingest/zeek.bacnet_discovery | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery index e7be92931..a2b155bf1 100644 --- a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery +++ b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery @@ -3,11 +3,14 @@ "processors" : [ { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename": { "field": "message2.object_type", "target_field": "bacnet.object,type", "ignore_missing": true } }, - { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, - { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, - { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, - { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "bacnet.is.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_service", "target_field": "bacnet.pdu.service", "ignore_missing": true } }, + { "rename": { "field": "message2.object_type", "target_field": "bacnet.object.type", "ignore_missing": true } }, + { "rename": { "field": "message2.instance_number", "target_field": "bacnet.instance.number", "ignore_missing": true } }, + { "rename": { "field": "message2.vendor", "target_field": "bacnet.vendor", "ignore_missing": true } }, + { "rename": { "field": "message2.range", "target_field": "bacnet.range", "ignore_missing": true } }, + { "rename": { "field": "message2.object_name", "target_field": "bacnet.object.name", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] }