{
  "description" : "zeek.stun",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "stun" } },
    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
    { "rename":   { "field": "message2.proto",               "target_field": "network.protocol",                           "ignore_missing": true } },
    { "rename":   { "field": "message2.is_orig",                  "target_field": "stun.is_orig",                      "ignore_missing": true } },
    { "rename":   { "field": "message2.trans_id",         "target_field": "stun.id",                     "ignore_missing": true } },
    { "rename":   { "field": "message2.method",               "target_field": "stun.method",                "ignore_missing": true } },
    { "rename":   { "field": "message2.class",    "target_field": "stun.class",        "ignore_missing": true } },
    { "rename":   { "field": "message2.attr_types", "target_field": "stun.attribute.types",          "ignore_missing": true } },
    { "rename":   { "field": "message2.attr_vals",           "target_field": "stun.attribute.values",               "ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}