{
  "description" : "zeek.websocket",
  "processors" : [
    { "set":      { "field": "event.dataset",                           "value": "websocket" } },
    { "remove":   { "field": ["host"],                                                          "ignore_failure": true    } },
    { "json":     { "field": "message",                                 "target_field": "message2",                       "ignore_failure": true    } },
    { "rename": 	{ "field": "message2.host",	                    "target_field": "websocket.host",		              "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.uri",	                    "target_field": "websocket.uri",		              "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.user_agent",	            "target_field": "websocket.user_agent",		          "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.subprotocol",	            "target_field": "websocket.subprotocol",		      "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_protocols",	    "target_field": "websocket.client_protocols",	      "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_extensions",	    "target_field": "websocket.client_extensions",	      "ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_extensions",	    "target_field": "websocket.server_extensions",	      "ignore_missing": true 	} },
    { "remove":		{ "field": "message2.tags",		                                                                      "ignore_failure": true    } },
    { "set":      { "field": "network.transport",                       "value": "tcp"  } },
    { "pipeline":       { "name": "zeek.common" } }
  ]
}