{
  "description" : "zeek.s7comm_read_szl",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "s7comm_read_szl" } },
    { "remove":   { "field": ["host"],									"ignore_failure": true } },
    { "json":     { "field": "message",				"target_field": "message2",		"ignore_failure": true } },
    { "rename":   { "field": "message2.pdu_reference",		"target_field": "s7.pdu_reference",	"ignore_missing": true } },
    { "rename":   { "field": "message2.method",			"target_field": "s7.method",		"ignore_missing": true } },
    { "rename":   { "field": "message2.szl_id",			"target_field": "s7.szl_id",		"ignore_missing": true } },
    { "rename":   { "field": "message2.szl_id_name",		"target_field": "s7.szl_id_name",	"ignore_missing": true } },
    { "rename":   { "field": "message2.szl_index",		"target_field": "s7.szl_index",		"ignore_missing": true } },
    { "rename":   { "field": "message2.return_code",		"target_field": "s7.return_code",	"ignore_missing": true } },
    { "rename":   { "field": "message2.return_code_name",	"target_field": "s7.return_code_name",	"ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}