{
  "description" : "import.wel",
  "processors" : [
    { "set":           { "field": "event.ingested", "value": "{{ @timestamp }}"  } },
    { "set" :          { "field" : "@timestamp", "value" : "{{ event.created }}" } },
    { "remove":        { "field": [ "event_record_id", "event.created" , "timestamp" , "winlog.event_data.UtcTime" ], "ignore_failure": true } },
    { "pipeline":      { "if": "ctx.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'",   "name": "sysmon" } },
    { "pipeline":      { "if": "ctx.winlog?.channel != 'Microsoft-Windows-Sysmon/Operational'",  "name":"win.eventlogs" } },
    { "pipeline":      { "name": "common" } }
  ]
}