{
  "description" : "suricata.smtp",
  "processors" : [
    { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.smtp.helo", 		"target_field": "smtp.helo",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.email.from", 		"target_field": "smtp.from",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.email.to", 		"target_field": "smtp.to",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.email.cc", 		"target_field": "smtp.cc",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.email.attachment", 		"target_field": "smtp.attachment",		"ignore_missing": true 	} },
    { "pipeline": { "name": "common" } }
  ]
}