{
  "description" : "zeek.files",
  "processors" : [
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.fuid", 	 	"target_field": "log.id.fuid",			"ignore_missing": true 	} },
    { "rename":         { "field": "message2.rx_hosts",         "target_field": "destination.ip",            "ignore_missing": true  } },
    { "rename": 	{ "field": "message2.tx_hosts", 	"target_field": "source.ip",		"ignore_missing": true 	} },
    { "set":         { "field": "server.ip",         "value": "{{source.ip}}",            "ignore_failure": true  } },
    { "set":         { "field": "client.ip",         "value": "{{destination.ip}}",            "ignore_failure": true  } },
    { "rename": 	{ "field": "message2.conn_uids", 	"target_field": "log.id.uids",			"ignore_missing": true 	} },
    { "remove": 	{ "field": "source",								"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.source", 		"target_field": "file.source",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.depth",	 	"target_field": "file.depth",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.analyzers", 	"target_field": "file.analyzer",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.mime_type", 	"target_field": "file.mime_type",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.filename", 	"target_field": "file.name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.duration", 	"target_field": "event.duration",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.local_orig",	"target_field": "file.local_orig",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.is_orig", 		"target_field": "file.is_orig",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.seen_bytes", 	"target_field": "file.bytes.seen",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.total_bytes", 	"target_field": "file.bytes.total",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.missing_bytes", 	"target_field": "file.bytes.missing",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.overflow_bytes",	"target_field": "file.bytes.overflow",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.timedout",		"target_field": "file.timed_out",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.parent_fuid",	"target_field": "log.id.parent_fuid",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.md5",		"target_field": "hash.md5",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.sha1",		"target_field": "hash.sha1",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted",	"target_field": "file.extracted.filename",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted_cutoff",	"target_field": "file.extracted.cutoff",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.extracted_size",	"target_field": "file.extracted.size",	"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common"                                                                                   } }
  ]
}