{
  "description" : "zeek.ntlm",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "ntlm" } },
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
    { "json":		{ "field": "message",				"target_field": "message2",			"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.hostname",			"target_field": "host.name",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.domainname",		"target_field": "host.domain",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.success", 			"target_field": "ntlm.success",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.status", 			"target_field": "ntlm.status",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.username",			"target_field": "user.name",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_dns_computer_name",	"target_field": "ntlm.server.dns.name", 	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_nb_computer_name",	"target_field": "ntlm.server.nb.name", 	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_tree_name",		"target_field": "ntlm.server.tree.name",		"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common"                                                                                   		} }
  ]
}