{
  "description" : "bro_ntlm",
  "processors" : [
    { "json":		{ "field": "message",				"target_field": "message2",			"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.uid", 	 		"target_field": "uid",				"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "id.orig_h", 			"path": "message2", 				"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.id.orig_h", 		"target_field": "source_ip",			"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "id.orig_p", 			"path": "message2",				"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.id.orig_p", 		"target_field": "source_port",			"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "id.resp_h", 			"path": "message2",				"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.id.resp_h", 		"target_field": "destination_ip",		"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "id.resp_p", 			"path": "message2",				"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.id.resp_p", 		"target_field": "destination_port",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.hostname",			"target_field": "hostname",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.domainname",		"target_field": "domain_name",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.success", 			"target_field": "ntlm_success",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.status", 			"target_field": "status",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.username",			"target_field": "username",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_dns_computer_name",	"target_field": "server_dns_computer_name", 	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_nb_computer_name",	"target_field": "server_nb_computer_name", 	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.server_tree_name",		"target_field": "server_tree_name",		"ignore_missing": true 	} },
    { "pipeline":       { "name": "bro_common"                                                                                   		} }
  ]
}