diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_header b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header
new file mode 100644
index 000000000..59f7bca04
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_header
@@ -0,0 +1,10 @@
+{
+  "description" : "zeek.bsap_ip_header",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.num_msg", 		"target_field": "bsap.number.messages",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.type_name", 	"target_field": "bsap.message.type",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
\ No newline at end of file
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb
new file mode 100644
index 000000000..6490e0aa9
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_rdb
@@ -0,0 +1,20 @@
+{
+  "description" : "zeek.bsap_ip_rdb",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.header_size", 		"target_field": "bsap.header.legnth",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.mes_seq", 	"target_field": "bsap.message.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.res_seq", 		"target_field": "bsap.response.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data_len", 		"target_field": "bsap.data.lenght",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sequence", 	"target_field": "bsap.function.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.app_func_code", 		"target_field": "bsap.application.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.node_status", 		"target_field": "bsap.node.status",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.func_code", 	"target_field": "bsap.application.sub.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_count", 		"target_field": "bsap.variable.count",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variables", 		"target_field": "bsap.vector.variables",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_value", 	"target_field": "bsap.vector.variable.value",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.value", 		"target_field": "bacnet.value",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown
new file mode 100644
index 000000000..2e94f55b5
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_ip_unknown
@@ -0,0 +1,9 @@
+{
+  "description" : "zeek.bsap_ip_unknown",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "bsap.ip.unknown.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_header b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header
new file mode 100644
index 000000000..1c81dbf2a
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_header
@@ -0,0 +1,17 @@
+{
+  "description" : "zeek.bsap_serial_header",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.ser", 		"target_field": "bsap.message.serial.number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dadd", 	"target_field": "bsap.destination.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sadd", 		"target_field": "bsap.scource.address",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.ctl", 	"target_field": "bsap.control.byte",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.dfun", 		"target_field": "bsap.destination.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.seq", 	"target_field": "bsap.message.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.sfun", 		"target_field": "bsap.source.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.nsb", 	"target_field": "bsap.node.status.byte",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.type_name", 	"target_field": "bsap.message.type",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
\ No newline at end of file
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb
new file mode 100644
index 000000000..71e0ad9e1
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb
@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.bsap_serial_rdb",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.func_code", 		"target_field": "bsap.rdb.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variables", 	"target_field": "bsap.vector.variables",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.variable_value", 		"target_field": "bsap.vector.value",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
\ No newline at end of file
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext
new file mode 100644
index 000000000..9809d68a0
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_rdb_ext
@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.bsap_serial_rdb_ext",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.dfun", 		"target_field": "bsap.destination.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.seq", 	"target_field": "bsap.message.sequence",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.nsb", 	"target_field": "bsap.node.status.byte",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.extfun", 	"target_field": "bsap.extenstion.function",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "bsap.extenstion.function.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
\ No newline at end of file
diff --git a/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown
new file mode 100644
index 000000000..2b9331c93
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bsap_serial_unknown
@@ -0,0 +1,9 @@
+{
+  "description" : "zeek.bsap_serial_unknown",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.data", 		"target_field": "bsap.serial.unknown.data",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}