{
  "description" : "zeek.rdp",
  "processors" : [
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.cookie", 		"target_field": "rdp.cookie",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.result", 		"target_field": "rdp.result",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.security_protocol","target_field": "rdp.security_protocol",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.keyboard_layout", 	"target_field": "rdp.keyboard_layout",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_build", 	"target_field": "rdp.client_build",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_name", 	"target_field": "client.name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.client_dig_product_id", 	"target_field": "client.id.product",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.desktop_width", 	"target_field": "rdp.desktop.width",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.desktop_height", 	"target_field": "rdp.desktop.height",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.requested_color_depth", 	"target_field": "rdp.requested_color_depth",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.cert_type", 	"target_field": "rdp.certificate_type",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.cert_count", 	"target_field": "rdp.certificate_count",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.cert_permanent", 	"target_field": "rdp.certificate_permanent","ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.encryption_level",	"target_field": "rdp.encryption_level",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.encryption_method","target_field": "rdp.encryption_method",	"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common"                                                                                   } }
  ]
}