securityonion/salt/elasticsearch/files/ingest/zeek.ldap_search

{
    "description":"zeek.ldap_search",
    "processors":[
        {"pipeline":    {"name": "zeek.ldap",       "ignore_missing_pipeline":true,"ignore_failure":true}},
        {"set":         {"field": "event.dataset",  "value":"ldap_search"}},
        {"remove":      {"field": "tags",           "ignore_missing":true}},
        {"pipeline":    {"name": "zeek.common"}}
    ]
}