elasticsearch.json

[
  {
    "set": {
      "field": "source.address",
      "value": "{{srcip}}",
      "if": "ctx.srcip != null"
    }
  },
  {
    "set": {
      "field": "source.ip",
      "value": "{{srcip}}",
      "if": "ctx.srcip != null"
    }
  },
  {
    "set": {
      "field": "source.ip",
      "value": "{{new_event.srcip}}",
      "if": "ctx.new_event?.srcip != null"
    }
  },
  {
    "date": {
      "field": "some_timestamp_field",
      "target_field": "@timestamp",
      "formats": [
        "UNIX_MS"
      ],
      "timezone": "UTC",
      "ignore_failure": true
    }
  },
  {
    "date": {
      "field": "some_other_timestamp",
      "target_field": "@timestamp",
      "formats": [
        "UNIX_MS"
      ],
      "timezone": "UTC",
      "ignore_failure": true
    }
  },
  {
    "date": {
      "field": "some_new_timestamp",
      "target_field": "destination_timestamp",
      "formats": [
        "UNIX"
      ],
      "timezone": "UTC",
      "ignore_failure": true
    }
  },
  {
    "rename": {
      "field": "srcport",
      "target_field": "source.port",
      "ignore_missing": true
    }
  },
  {
    "convert": {
      "field": "source.port",
      "type": "long",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "set": {
      "field": "destination.address",
      "value": "{{destip}}",
      "if": "ctx.destip != null"
    }
  },
  {
    "set": {
      "field": "destination.port",
      "value": "{{destport}}",
      "if": "ctx.destport != null"
    }
  },
  {
    "convert": {
      "field": "destination.port",
      "type": "long",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "set": {
      "field": "timestamp",
      "value": "{{ts}}",
      "if": "ctx.ts != null"
    }
  },
  {
    "rename": {
      "field": "action",
      "target_field": "event.action",
      "ignore_missing": true
    }
  },
  {
    "lowercase": {
      "field": "event.action",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "rename": {
      "field": "duration",
      "target_field": "event.duration",
      "ignore_missing": true
    }
  },
  {
    "convert": {
      "field": "event.duration",
      "type": "float",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "rename": {
      "field": "user_agent",
      "target_field": "user_agent.original",
      "ignore_missing": true
    }
  },
  {
    "rename": {
      "field": "log_level",
      "target_field": "log.level",
      "ignore_missing": true
    }
  },
  {
    "uppercase": {
      "field": "log.level",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "rename": {
      "field": "eventid",
      "target_field": "event.id",
      "ignore_missing": true
    }
  },
  {
    "convert": {
      "field": "event.id",
      "type": "string",
      "ignore_missing": true,
      "ignore_failure": true
    }
  },
  {
    "rename": {
      "field": "hostip",
      "target_field": "host.ip",
      "ignore_missing": true
    }
  },
  {
    "append": {
      "field": "host.ip",
      "value": [

      ],
      "ignore_failure": true,
      "if": "ctx.host?.ip != null"
    }
  }
]