diff --git a/salt/elasticsearch/files/ingest/bro_tunnel b/salt/elasticsearch/files/ingest/bro_tunnel
new file mode 100644
index 000000000..21fa06deb
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/bro_tunnel
@@ -0,0 +1,7 @@
+{
+  "description" : "bro_tunnel",
+  "processors" : [
+    { "set":		{ "field": "event_type", "value": "bro_tunnels"								} },
+    { "pipeline":       { "name": "bro_tunnels"                                                                                 } }
+  ]
+}