{
  "description" : "zeek.opcua_stats_code_detail",
  "processors" : [
    { "remove":   { "field": ["host"],                                                                                              "ignore_failure": true } },
    { "json":     { "field": "message",			             "target_field": "message2",		                    "ignore_failure": true} },
    { "rename":   { "field": "message2.status_code_link_id",         "target_field": "opcua.status_code.link_id",                   "ignore_missing": true } },
    { "rename":   { "field": "message2.source", 	             "target_field": "opcua.source",		                    "ignore_missing": true } },
    { "rename":   { "field": "message2.source_str", 		     "target_field": "opcua.source_string",		            "ignore_missing": true } },
    { "rename":   { "field": "message2.source_level", 	             "target_field": "opcua.source_level",		            "ignore_missing": true } },
    { "rename":   { "field": "message2.status_code", 	             "target_field": "opcua.status_code",	                    "ignore_missing": true } },
    { "rename":   { "field": "message2.severity", 	             "target_field": "opcua.severity",		                    "ignore_missing": true } },
    { "rename":   { "field": "message2.severity_str",                "target_field": "opcua.severity_string",	                    "ignore_missing": true } },
    { "rename":   { "field": "message2.sub_code", 		     "target_field": "opcua.sub_code",		                    "ignore_missing": true } },
    { "rename":   { "field": "message2.sub_code_str",                "target_field": "opcua.sub_code_string",                       "ignore_missing": true } },
    { "rename":   { "field": "message2.structure_changed",           "target_field": "opcua.structure_changed",                     "ignore_missing": true } },
    { "rename":   { "field": "message2.semantics_changed",           "target_field": "opcua.semantics_changed",                     "ignore_missing": true } },
    { "rename":   { "field": "message2.info_type",            	     "target_field": "opcua.info_type",                             "ignore_missing": true } },
    { "rename":   { "field": "message2.info_type_str",               "target_field": "opcua.info_type_string",                      "ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}