diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm_upload_download b/salt/elasticsearch/files/ingest/zeek.s7comm_upload_download
new file mode 100644
index 000000000..51d8ca03f
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.s7comm_upload_download
@@ -0,0 +1,18 @@
+{
+  "description" : "zeek.s7comm_upload_download",
+  "processors" : [
+    { "remove":   { "field": ["host"],									"ignore_failure": true } },
+    { "json":     { "field": "message",				"target_field": "message2",		"ignore_failure": true } },
+    { "rename":   { "field": "message2.rosctr",                 "target_field": "s7.ros.control.name",  "ignore_missing": true } },
+    { "rename":   { "field": "message2.pdu_reference",		"target_field": "s7.pdu_reference",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.function_code",		"target_field": "s7.function_code",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.function_status",        "target_field": "s7.function_status",   "ignore_missing": true } },
+    { "rename":   { "field": "message2.session_id",             "target_field": "s7.session_id",        "ignore_missing": true } },
+    { "rename":   { "field": "message2.blocklength",            "target_field": "s7.block.length",      "ignore_missing": true } },
+    { "rename":   { "field": "message2.filename",               "target_field": "s7.file.name",         "ignore_missing": true } },
+    { "rename":   { "field": "message2.block_type",             "target_field": "s7.block.type",        "ignore_missing": true } },
+    { "rename":   { "field": "message2.block_number",           "target_field": "s7.block.number",      "ignore_missing": true } },
+    { "rename":   { "field": "message2.destination_filesystem", "target_field": "s7.destination.filesystem", "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}