{
  "description" : "zeek.s7comm",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "s7comm" } },
    { "remove":   { "field": ["host"],								"ignore_failure": true } },
    { "json":     { "field": "message",			"target_field": "message2",		"ignore_failure": true } },
    { "rename":   { "field": "message2.rosctr_code",	"target_field": "s7.ros.control.code",	"ignore_missing": true } },
    { "rename":   { "field": "message2.rosctr_name",	"target_field": "s7.ros.control.name",	"ignore_missing": true } },
    { "rename":   { "field": "message2.pdu_reference",	"target_field": "s7.pdu_reference",	"ignore_missing": true } },
    { "rename":   { "field": "message2.function_code",	"target_field": "s7.function.code",	"ignore_missing": true } },
    { "rename":   { "field": "message2.function_name",	"target_field": "s7.function.name",	"ignore_missing": true } },
    { "rename":   { "field": "message2.error_class",	"target_field": "s7.error.class",	"ignore_missing": true } },
    { "rename":   { "field": "message2.error_code",	"target_field": "s7.error.code",	"ignore_missing": true } },
    { "pipeline": { "name": "zeek.common" } }
  ]
}