diff --git a/salt/elasticsearch/files/ingest/filterlog b/salt/elasticsearch/files/ingest/filterlog
index d40874205..d7bda9539 100644
--- a/salt/elasticsearch/files/ingest/filterlog
+++ b/salt/elasticsearch/files/ingest/filterlog
@@ -52,8 +52,8 @@
      },
      { "set":         { "field": "_index",        "value": "so-firewall", "override": true           } },
      { "set":         { "if": "ctx.network?.transport_id == '0'", "field": "network.transport",        "value": "icmp", "override": true           } },
-     { "set":         { "field": "event.module",        "value": "pfsense", "override": true           } },
-     { "set":         { "field": "event.dataset",        "value": "firewall", "override": true           } },
+     { "set":         { "field": "module",        "value": "pfsense", "override": true           } },
+     { "set":         { "field": "dataset",        "value": "firewall", "override": true           } },
      { "remove":      { "field": ["real_message", "ip_sub_msg", "firewall.sub_message"],     "ignore_failure": true                                                                  } },
      { "append":      { "field": "tags", "value": ["pfsense"]                                   } }
   ]
diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json
index 43a4c7378..cc4c4595b 100644
--- a/salt/elasticsearch/templates/so/so-common-template.json
+++ b/salt/elasticsearch/templates/so/so-common-template.json
@@ -257,7 +257,11 @@
           "type":"object",
           "dynamic": true
         },
-	      "irc":{
+	"ip":{
+          "type":"object",
+          "dynamic": true
+        }, 
+	"irc":{
           "type":"object",
           "dynamic": true
         },
@@ -273,7 +277,7 @@
           "type":"object",
           "dynamic": true
         },
-	      "message":{  
+	"message":{  
           "type":"text",
           "fields":{  
             "keyword":{