type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$"]
tags: {{.tags}}

json.keys_under_root: false

processors:
  - drop_fields:
      fields: ["json.x509"]
  - rename:
      fields:
        - from: "json"
          to: "zeek.files"

        - from: "zeek.files.conn_uids"
          to: "zeek.files.session_ids"
              
      ignore_missing: true
      fail_on_error: false
