{
  "description" : "zeek.dhcp",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "dhcp" } },
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } }, 
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.uids", 	 	"target_field": "log.id.uids",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.mac", 		"target_field": "host.mac",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.assigned_ip",	"target_field": "dhcp.assigned_ip",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.lease_time", 	"target_field": "dhcp.lease_time",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.trans_id", 	"target_field": "dhcp.transaction_id",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.assigned_addr", 	"target_field": "dhcp.assigned_ip",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_addr", 	"target_field": "client.address",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_addr", 	"target_field": "server.address",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.requested_addr", 	"target_field": "dhcp.requested_address",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.domain", 		"target_field": "host.domain",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.host_name",	"target_field": "host.hostname",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.duration",		"target_field": "event.duration",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.msg_types", 	"target_field": "dhcp.message_types",	"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common"                                                                                   } }
  ]
}