{
  "description" : "zeek.opcua_binary",
  "processors" : [
    { "remove":   { "field": ["host"],												"ignore_failure": true } },
    { "json":     { "field": "message",					"target_field": "message2",				"ignore_failure": true } },
    { "rename":   { "field": "message2.msg_type",			"target_field": "opcua.message_type",			"ignore_missing": true } },
    { "rename":   { "field": "message2.is_final",			"target_field": "opcua.final",				"ignore_missing": true } },
    { "rename":   { "field": "message2.msg_size",			"target_field": "opcua.message_size",			"ignore_missing": true } },
    { "rename":   { "field": "message2.snd_buf_size",			"target_field": "opcua.sender.buffer_size",		"ignore_missing": true } },
    { "rename":   { "field": "message2.seq_number",			"target_field": "opcua.sequence_number",		"ignore_missing": true } },
    { "rename":   { "field": "message2.sec_channel_id",			"target_field": "opcua.secure_channel_id",		"ignore_missing": true } },
    { "rename":   { "field": "message2.seq_number",			"target_field": "opcua.sequence_number",		"ignore_missing": true } },
    { "rename":   { "field": "message2.opcua_link_id",			"target_field": "opcua.link_id",			"ignore_missing": true } },
    { "rename":   { "field": "message2.request_id",			"target_field": "opcua.request_id",			"ignore_missing": true } },
    { "rename":   { "field": "message2.namespace_idx",			"target_field": "opcua.namespace_index",		"ignore_missing": true } },
    { "rename":   { "field": "message2.encoding_mask",			"target_field": "opcua.encoding_mask",			"ignore_missing": true } },
    { "convert":  { "field": "opcua.encoding_mask", 			"type": "string",
 "ignore_missing": true } },
    { "rename":   { "field": "message2.identifier",			"target_field": "opcua.identifier",			"ignore_missing": true } },
    { "rename":   { "field": "message2.identifier_str",			"target_field": "opcua.identifier_string",		"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_node_id_type",		"target_field": "opcua.request.header.node.id_type",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_node_id_numeric",	"target_field": "opcua.request.header.node.id_numeric",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_timestamp",		"target_field": "opcua.request.header.timestamp",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_request_handle",		"target_field": "opcua.request.handle",			"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_return_diag",		"target_field": "opcua.request.header.return_diag",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_audit_entry_id",		"target_field": "opcua.request.header.audit_entry_id",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_timeout_hint",		"target_field": "opcua.request.header.timeout_hint",	"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_add_hdr_type_id",	"target_field": "opcua.request.header.type_id",		"ignore_missing": true } },
    { "rename":   { "field": "message2.req_hdr_add_hdr_enc_mask",	"target_field": "opcua.request.header.enc_mask",	"ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}