{
  "description": "Pipeline for normalizing Zeek http.log",
  "processors": [
    {
      "script": {
        "lang": "painless",
        "source": "ctx.event.created = ctx['@timestamp']; ctx['@timestamp'] = (long)ctx['zeek']['http']['ts'] * 1000; ctx.zeek.http.remove('ts');"
      }
    },
    {
      "set": {
        "field": "event.id",
        "value": "{{zeek.session_id}}",
        "if": "ctx.zeek.session_id != null"
      }
    },
    {
      "set": {
        "field": "source.ip",
        "value": "{{source.address}}"
      }
    },
    {
      "set": {
        "field": "destination.ip",
        "value": "{{destination.address}}"
      }
    },
    {
      "set": {
        "field": "url.port",
        "value": "{{destination.port}}"
      }
    },
    {
      "geoip": {
        "field": "destination.ip",
        "target_field": "destination.geo"
      }
    },
    {
      "geoip": {
        "field": "source.ip",
        "target_field": "source.geo"
      }
    },
    {
      "geoip": {
        "database_file": "GeoLite2-ASN.mmdb",
        "field": "source.ip",
        "target_field": "source.as",
        "properties": [
          "asn",
          "organization_name"
        ],
        "ignore_missing": true
      }
    },
    {
      "geoip": {
        "database_file": "GeoLite2-ASN.mmdb",
        "field": "destination.ip",
        "target_field": "destination.as",
        "properties": [
          "asn",
          "organization_name"
        ],
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "source.as.asn",
        "target_field": "source.as.number",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "source.as.organization_name",
        "target_field": "source.as.organization.name",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "destination.as.asn",
        "target_field": "destination.as.number",
        "ignore_missing": true
      }
    },
    {
      "rename": {
        "field": "destination.as.organization_name",
        "target_field": "destination.as.organization.name",
        "ignore_missing": true
      }
    },
    {
      "user_agent": {
        "field": "user_agent.original",
        "ignore_missing": true
      }
    }
  ],
  "on_failure" : [{ 
    "set" : { 
      "field" : "error.message", 
      "value" : "{{ _ingest.on_failure_message }}" 
    } 
  }]
}
