From 083c588a87ff5228f1ef58199aef12269e7eeedf Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Tue, 24 Mar 2020 03:43:31 +0000 Subject: [PATCH] add some more fields --- salt/elasticsearch/files/ingest/zeek.weird | 3 +++ 1 file changed, 3 insertions(+) diff --git a/salt/elasticsearch/files/ingest/zeek.weird b/salt/elasticsearch/files/ingest/zeek.weird index 7e2643fe4..7c138f991 100644 --- a/salt/elasticsearch/files/ingest/zeek.weird +++ b/salt/elasticsearch/files/ingest/zeek.weird @@ -6,6 +6,9 @@ { "rename": { "field": "message2.addl", "target_field": "weird.additional_info", "ignore_missing": true } }, { "rename": { "field": "message2.notice", "target_field": "weird.notice", "ignore_missing": true } }, { "rename": { "field": "message2.peer", "target_field": "weird.peer", "ignore_missing": true } }, + { "rename": { "field": "message2.p", "target_field": "weird.p", "ignore_missing": true } }, + { "rename": { "field": "message2.dst", "target_field": "destination.ip", "ignore_missing": true } }, + { "rename": { "field": "message2.src", "target_field": "source.ip", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } } ] }