{
  "description" : "bro_files",
  "processors" : [
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.fuid", 	 	"target_field": "fuid",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.tx_hosts", 	"target_field": "file_ip",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rx_hosts.0",	"target_field": "destination_ip",	"ignore_missing": true 	} },
    { "remove": 	{ "field": "message2.rx_hosts",							"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.conn_uids", 	"target_field": "uid",			"ignore_missing": true 	} },
    { "remove": 	{ "field": "source",								"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.source", 		"target_field": "source",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.depth",	 	"target_field": "depth",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.analyzers", 	"target_field": "analyzer",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.mime_type", 	"target_field": "mimetype",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.filename", 	"target_field": "file_name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.duration", 	"target_field": "duration",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.local_orig",	"target_field": "local_orig",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.is_orig", 		"target_field": "is_orig",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.seen_bytes", 	"target_field": "seen_bytes",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.total_bytes", 	"target_field": "total_bytes",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.missing_bytes", 	"target_field": "missing_bytes",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.overflow_bytes",	"target_field": "overflow_bytes",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.timedout",		"target_field": "timed_out",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.parent_fuid",	"target_field": "parent_fuid",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.md5",		"target_field": "md5",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.sha1",		"target_field": "sha1",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted",	"target_field": "extracted",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted_cutoff",	"target_field": "extracted_cutoff",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted_size",	"target_field": "extracted_size",	"ignore_missing": true 	} },
    { "pipeline":       { "name": "bro_common"                                                                                   } }
  ]
}