type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$"]
tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

json.keys_under_root: false

processors:
  - drop_fields:
      fields: ["json.actions"]
      ignore_missing: true
  - rename:
      fields:
        - from: "json"
          to: "zeek.notice"

        - from: "zeek.notice.src"
          to: "source.address"

        - from: "zeek.notice.dst"
          to: "destination.address"

        - from: "zeek.notice.uid"
          to: "zeek.session_id"

        - from: "zeek.notice.p"
          to: "destination.port"

        - from: "zeek.notice.conn"
          to: "zeek.notice.connnection_id"

        - from: "zeek.notice.iconn"
          to: "zeek.notice.icmp_id"

        - from: "zeek.notice.id.orig_h"
          to: "source.address"

        - from: "zeek.notice.id.orig_p"
          to: "source.port"

        - from: "zeek.notice.id.resp_h"
          to: "destination.address"

        - from: "zeek.notice.id.resp_p"
          to: "destination.port"

        - from: "zeek.notice.proto"
          to: "network.transport"

        - from: "zeek.notice.id.orig_p"
          to: "source.port"

        - from: "zeek.notice.f.id"
          to: "zeek.notice.file.id"

        - from: "zeek.notice.f.parent_id"
          to: "zeek.notice.file.parent_id"

        - from: "zeek.notice.f.source"
          to: "zeek.notice.file.source"

        - from: "zeek.notice.f.is_orig"
          to: "zeek.notice.file.is_orig"

        - from: "zeek.notice.f.seen_bytes"
          to: "zeek.notice.file.seen_bytes"

        - from: "zeek.notice.f.total_bytes"
          to: "zeek.notice.file.total_bytes"

        - from: "zeek.notice.file_mime_type"
          to: "zeek.notice.file.mime_type"

      ignore_missing: true
      fail_on_error: false

  - drop_fields:
      fields: ["zeek.notice.remote_location", "zeek.notice.f"]
      ignore_missing: true
  - convert:
      fields:
        - {from: "zeek.session_id", to: "event.id"}
        - {from: "source.address", to: "source.ip", type: "ip"}
        - {from: "destination.address", to: "destination.ip", type: "ip"}
        - {from: "zeek.notice.file.total_bytes", to: "file.size"}
        - {from: "zeek.notice.file.mime_type", to: "file.mime_type"}
        - {from: "zeek.notice.note", to: "rule.name"}
        - {from: "zeek.notice.msg", to: "rule.description"}
      ignore_missing: true
      fail_on_error: false
  - add_fields:
      target: event
      fields:
        kind: alert
        category:
          - intrusion_detection
        type:
          - info
  - community_id:
  - add_fields:
      target: ''
      fields:
        ecs.version: 1.7.0
