From cb899943aa704e80c5c55a04d7fd4aeaf5ea5d4b Mon Sep 17 00:00:00 2001
From: doug <doug.burks@gmail.com>
Date: Tue, 24 Sep 2019 14:00:22 -0400
Subject: [PATCH] incoming bro_tunnel logs should go to bro_tunnels

---
 salt/elasticsearch/files/ingest/bro_tunnel | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 salt/elasticsearch/files/ingest/bro_tunnel

diff --git a/salt/elasticsearch/files/ingest/bro_tunnel b/salt/elasticsearch/files/ingest/bro_tunnel
new file mode 100644
index 000000000..21fa06deb
--- /dev/null
+++ b/salt/elasticsearch/files/ingest/bro_tunnel
@@ -0,0 +1,7 @@
+{
+  "description" : "bro_tunnel",
+  "processors" : [
+    { "set":		{ "field": "event_type", "value": "bro_tunnels"								} },
+    { "pipeline":       { "name": "bro_tunnels"                                                                                 } }
+  ]
+}