From 9ac06057c103ce879475cf0c4dc1145d580654d6 Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Fri, 21 Oct 2022 13:00:12 -0700 Subject: [PATCH] Create zeek.read_write_multiple_registers --- .../ingest/zeek.read_write_multiple_registers | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.read_write_multiple_registers diff --git a/salt/elasticsearch/files/ingest/zeek.read_write_multiple_registers b/salt/elasticsearch/files/ingest/zeek.read_write_multiple_registers new file mode 100644 index 000000000..e60c593fe --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.read_write_multiple_registers @@ -0,0 +1,16 @@ +{ + "description" : "zeek.read_write_multiple_registers", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.unit_id", "target_field": "modbus.unit.id", "ignore_missing": true } }, + { "rename": { "field": "message2.func", "target_field": "modbus.function", "ignore_missing": true } }, + { "rename": { "field": "message2.network_direction", "target_field": "modbus.network.direction", "ignore_missing": true } }, + { "rename": { "field": "message2.write_start_address", "target_field": "modbus.write.start.address", "ignore_missing": true } }, + { "rename": { "field": "message2.write_registers", "target_field": "modbus.write.registers", "ignore_missing": true } }, + { "rename": { "field": "message2.read_start_address", "target_field": "modbus.write.start.address", "ignore_missing": true } }, + { "rename": { "field": "message2.read.quality", "target_field": "modbus.read.quality", "ignore_missing": true } }, + { "rename": { "field": "message2.read_registers", "target_field": "modbus.read.registers", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +}