{
  "description" : "zeek.smtp",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "smtp" } },
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "remove":		{ "field": "path",			"ignore_failure": true						} },
    { "rename": 	{ "field": "message2.trans_depth", 	"target_field": "smtp.transaction_depth",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.helo", 		"target_field": "smtp.helo",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.mailfrom", 	"target_field": "smtp.mail_from",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.rcptto", 		"target_field": "smtp.recipient_to",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.date", 		"target_field": "smtp.mail_date",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.from", 		"target_field": "smtp.from",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.to", 		"target_field": "smtp.to",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.cc", 		"target_field": "smtp.cc",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.reply_to", 	"target_field": "smtp.reply_to",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.msg_id", 		"target_field": "smtp.message_id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.in_reply_to", 	"target_field": "smtp.in_reply_to",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.subject", 		"target_field": "smtp.subject",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.x_originating_ip",	"target_field": "smtp.x_originating_ip",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.first_received", 	"target_field": "smtp.first_received",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.second_received",	"target_field": "smtp.second_received",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.last_reply",	"target_field": "smtp.last_reply",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.path", 		"target_field": "smtp.path",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.user_agent", 	"target_field": "smtp.useragent",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.tls", 		"target_field": "smtp.tls",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fuids", 		"target_field": "log.id.fuids",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.is_webmail",	"target_field": "smtp.is_webmail",		"ignore_missing": true 	} },
    { "set":      { "field": "network.transport",        "value": "tcp"  } },
    { "pipeline":       { "name": "zeek.common"                                                                                   } }
  ]
}