{
  "description" : "zeek.opcua_binary_opensecure_channel",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "opcua_binary_opensecure_channel" } },
    { "remove":   { "field": ["host"],												"ignore_failure": true } },
    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
    { "rename":   { "field": "message2.opcua_link_id",			"target_field": "opcua.link_id",			"ignore_missing": true } },
    { "rename":   { "field": "message2.server_proto_ver",		"target_field": "opcua.server_proto_ver",		"ignore_missing": true } },
    { "rename":   { "field": "message2.sec_token_sec_channel_id",	"target_field": "opcua.sec_token_sec_channel_id",	"ignore_missing": true } },
    { "rename":   { "field": "message2.sec_token_id",			"target_field": "opcua.sec_token_id",			"ignore_missing": true } },
    { "rename":   { "field": "message2.sec_token_created_at",		"target_field": "opcua.sec_token_created_at",		"ignore_missing": true } },
    { "rename":   { "field": "message2.sec_token_revised_time",		"target_field": "opcua.sec_token_revised_time",		"ignore_missing": true } },
    { "rename":   { "field": "message2.server_nonce",			"target_field": "opcua.server_nonce",			"ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}