From b97c8228001fde18203a6aa42eecb4ecaa7724bf Mon Sep 17 00:00:00 2001
From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com>
Date: Thu, 27 Oct 2022 15:40:52 -0700
Subject: [PATCH] Add zeek.bacnet_discovery and zeek.bacnet_property

---
 .../files/ingest/zeek.bacnet_discovery              | 13 +++++++++++++
 .../elasticsearch/files/ingest/zeek.bacnet_property | 11 +++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 salt/elasticsearch/files/ingest/zeek.bacnet_discovery
 create mode 100644 salt/elasticsearch/files/ingest/zeek.bacnet_property

diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_discovery b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery
new file mode 100644
index 000000000..e7be92931
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bacnet_discovery
@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.bacnet_discovery",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.object_type", 		"target_field": "bacnet.object,type",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.instance_number", 	"target_field": "bacnet.instance.number",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.vendor", 		"target_field": "bacnet.vendor",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.range", 		"target_field": "bacnet.range",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.object_name", 		"target_field": "bacnet.object.name",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}
diff --git a/salt/elasticsearch/files/ingest/zeek.bacnet_property b/salt/elasticsearch/files/ingest/zeek.bacnet_property
new file mode 100644
index 000000000..09ea3dae2
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/zeek.bacnet_property
@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.bacnet_property",
+  "processors" : [
+    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
+    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
+    { "rename": 	{ "field": "message2.property", 		"target_field": "bacnet.property",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.array_index", 	"target_field": "bacnet.array.index",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.value", 		"target_field": "bacnet.value",		"ignore_missing": true 	} },
+    { "pipeline":       { "name": "zeek.common"                                                                                   } }
+  ]
+}