diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert b/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert
index 0abadc290..fe6f577eb 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_client_software_cert
@@ -3,7 +3,7 @@
   "processors" : [
     { "remove":   { "field": ["host"],												"ignore_failure": true } },
     { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
-    { "rename":   { "field": "message2.client_software_cert_link_id",	"target_field": "opcua.client_software_cert.link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.client_software_cert_link_id",	"target_field": "opcua.client_software_cert_link_id",	"ignore_missing": true } },
     { "rename":   { "field": "message2.cert_data", 			"target_field": "opcua.certificate.data",		"ignore_missing": true } },
     { "rename":   { "field": "message2.cert_signature",			"target_field": "opcua.certificate.signature",		"ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info
index 90cdf2b62..283d1c78e 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_activate_session_diagnostic_info
@@ -3,8 +3,8 @@
   "processors" : [
     { "remove":   { "field": ["host"],														"ignore_failure": true } },
     { "json":     { "field": "message",						"target_field": "message2",					"ignore_failure": true } },
-    { "rename":   { "field": "message2.activate_session_diag_info_link_id",	"target_field": "opcua.activate_session_diag_info.link_id",	"ignore_missing": true } },
-    { "rename":   { "field": "message2.diag_info_link_id",			"target_field": "opcua.diag_info.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.activate_session_diag_info_link_id",	"target_field": "opcua.activate_session_diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id",			"target_field": "opcua.diag_info_link_id",			"ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }
   ]
 }
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse
index f6e2f3630..fa2f24335 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse
@@ -11,7 +11,7 @@
     { "rename":   { "field": "message2.browse_view_id_numeric",			"target_field": "opcua.identifier_numeric",		"ignore_missing": true } },
     { "rename":   { "field": "message2.browse_view_description_timestamp",	"target_field": "opcua.view.description_timestamp",	"ignore_missing": true } },
     { "rename":   { "field": "message2.browse_view_description_view_version",	"target_field": "opcua.description.view_version",	"ignore_missing": true } },
-    { "rename":   { "field": "message2.browse_description_link_id",		"target_field": "opcua.description.link_id",		"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_description_link_id",		"target_field": "opcua.description_link_id",		"ignore_missing": true } },
     { "rename":   { "field": "message2.req_max_ref_nodes",			"target_field": "opcua.request.max_ref_nodes",		"ignore_missing": true } },  
     { "pipeline": { "name": "zeek.common" } }
   ]
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info
index 3d58d8030..43560f4f0 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_diagnostic_info
@@ -3,8 +3,8 @@
   "processors" : [
     { "remove":   { "field": ["host"],													"ignore_failure": true } },
     { "json":     { "field": "message",					"target_field": "message2",					"ignore_failure": true } },
-    { "rename":   { "field": "message2.browse_diag_info_link_id",	"target_field": "opcua.browse_session_diag_info.link_id",	"ignore_missing": true } },
-    { "rename":   { "field": "message2.diag_info_link_id", 		"target_field": "opcua.diag_info.link_id",			"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_diag_info_link_id",	"target_field": "opcua.browse_session_diag_info_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.diag_info_link_id", 		"target_field": "opcua.diag_info_link_id",			"ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }
   ]
 }
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result
index 857e7ffb5..d9eabbd87 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_browse_result
@@ -3,9 +3,9 @@
   "processors" : [
     { "remove":   { "field": ["host"],											"ignore_failure": true } },
     { "json":     { "field": "message",					"target_field": "message2",			"ignore_failure": true } },
-    { "rename":   { "field": "message2.browse_response_link_id",	"target_field": "opcua.response.link_id",	"ignore_missing": true } },
-    { "rename":   { "field": "message2.browse_reference.link_id",	"target_field": "opcua.reference.link_id",	"ignore_missing": true } },
-    { "rename":   { "field": "message2.status_code.link_id",		"target_field": "opcua.status_code.link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_response_link_id",	"target_field": "opcua.response_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.browse_reference_link_id",	"target_field": "opcua.reference_link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.status_code_link_id",		"target_field": "opcua.status_code_link_id",	"ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }
   ]
 }
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token b/salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token
index 722ca2fd0..e699aad0a 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_create_session_user_token
@@ -3,7 +3,7 @@
   "processors" : [
     { "remove":   { "field": ["host"],										"ignore_failure": true } },
     { "json":     { "field": "message",				"target_field": "message2",			"ignore_failure": true } },
-    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token.link_id",	"ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token_link_id",	"ignore_missing": true } },
     { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token.policy_id",	"ignore_missing": true } },
     { "rename":   { "field": "message2.user_token_link_id",	"target_field": "opcua.user_token.type",	"ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }
diff --git a/salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token b/salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token
index 524456511..88fabe801 100644
--- a/salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token
+++ b/salt/elasticsearch/files/ingest/zeek.opcua_binary_get_endpoints_user_token
@@ -3,7 +3,7 @@
   "processors" : [
     { "remove":   { "field": ["host"],                                                                                                         "ignore_failure": true } },
     { "json":     { "field": "message",			                 "target_field": "message2",		                               "ignore_failure": true } },
-    { "rename":   { "field": "message2.user_token_link_id", 	         "target_field": "opcua.user_token.link_id",		               "ignore_missing": true } },
+    { "rename":   { "field": "message2.user_token_link_id", 	         "target_field": "opcua.user_token_link_id",		               "ignore_missing": true } },
     { "rename":   { "field": "message2.user_token_type",                 "target_field": "opcua.user_token.type",                              "ignore_missing": true } },
     { "rename":   { "field": "message2.user_token_sec_policy_uri",       "target_field": "opcua.user_token.security_policy_uri",               "ignore_missing": true } },
     { "pipeline": { "name": "zeek.common" } }