{
  "description" : "zeek.intel",
  "processors" : [
    { "remove":         { "field": ["host"],     "ignore_failure": true                                                                  } },
    { "json":		{ "field": "message",			"target_field": "message2",		"ignore_failure": true	} },
    { "dot_expander":   { "field": "seen.indicator",    "path": "message2",                     "ignore_failure": true  } },
    { "rename": 	{ "field": "message2.seen.indicator", 	"target_field": "intel.indicator",		"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "seen.indicator_type", 	"path": "message2",			"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.seen.indicator_type", 	"target_field": "intel.indicator_type",		"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "seen.where", 		"path": "message2",			"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.seen.where", 	"target_field": "intel.seen_where",		"ignore_missing": true 	} },
    { "dot_expander": 	{ "field": "seen.node", 		"path": "message2",			"ignore_failure": true 	} },
    { "rename": 	{ "field": "message2.seen.node", 	"target_field": "intel.seen_node",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.matched", 		"target_field": "intel.matched",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.sources", 		"target_field": "intel.sources",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.fuid", 		"target_field": "log.id.fuid",			"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.file_mime_type", 	"target_field": "file.mimetype",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.file_desc", 	"target_field": "file.description",	"ignore_missing": true 	} },
    { "pipeline":       { "name": "zeek.common"                                                                                   } }
  ]
}