{
  "description" : "zeek.cip_identity",
  "processors" : [
    { "set": { "field": "event.dataset", "value": "cip_identity" } },
    { "remove":         { "field": ["host"],										"ignore_failure": true	} },
    { "json":		{ "field": "message",				"target_field": "message2",			"ignore_failure": true	} },
    { "rename": 	{ "field": "message2.encapsulation_version",	"target_field": "cip.encapsulation.version",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.socket_address",		"target_field": "cip.socket.address",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.socket_port",		"target_field": "cip.socket.port",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.vendor_id",		"target_field": "cip.vendor.id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.vendor_name",		"target_field": "cip.vendor.name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.device_type_id",		"target_field": "cip.device.type.id",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.device_type_name",		"target_field": "cip.device.type.name",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.product_code",		"target_field": "cip.device.product.code",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.revision",			"target_field": "cip.device.revision",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.device_status",		"target_field": "cip.device.status",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.serial_number",		"target_field": "cip.device.serial_number",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.product_name",		"target_field": "cip.device.product.name",	"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.device_state",		"target_field": "cip.device.state",		"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common" } }
  ]
}