diff --git a/dashboards/dashboards/29a1b290-eb98-11e9-a384-0fcf32210194.json b/dashboards/dashboards/29a1b290-eb98-11e9-a384-0fcf32210194.json
index 965fadb4e..9940028e3 100644
--- a/dashboards/dashboards/29a1b290-eb98-11e9-a384-0fcf32210194.json
+++ b/dashboards/dashboards/29a1b290-eb98-11e9-a384-0fcf32210194.json
@@ -368,7 +368,6 @@
           "destination.ip",
           "event.action",
           "event.result",
-          "network.is_orig",
           "zeek.cip.direction",
           "zeek.cip.cip_sequence_count",
           "zeek.cip.class_id",
@@ -457,7 +456,6 @@
           "destination.ip",
           "event.action",
           "event.result",
-          "network.is_orig",
           "zeek.enip.options",
           "zeek.enip.sender_context",
           "zeek.enip.session_handle",
@@ -500,7 +498,6 @@
         "columns": [
           "source.ip",
           "destination.ip",
-          "network.is_orig",
           "zeek.cip_io.connection_id",
           "zeek.cip_io.sequence_number",
           "zeek.cip_io.data_length",
diff --git a/dashboards/dashboards/2bec1490-eb94-11e9-a384-0fcf32210194.json b/dashboards/dashboards/2bec1490-eb94-11e9-a384-0fcf32210194.json
index fbca23fdf..2f218e86c 100644
--- a/dashboards/dashboards/2bec1490-eb94-11e9-a384-0fcf32210194.json
+++ b/dashboards/dashboards/2bec1490-eb94-11e9-a384-0fcf32210194.json
@@ -435,7 +435,6 @@
         "columns": [
           "source.ip",
           "destination.ip",
-          "network.is_orig",
           "zeek.bacnet.bvlc_function",
           "zeek.bacnet.pdu_type",
           "zeek.bacnet.pdu_service",
@@ -478,7 +477,6 @@
         "columns": [
           "source.ip",
           "destination.ip",
-          "network.is_orig",
           "zeek.bacnet_property.pdu_service",
           "zeek.bacnet_property.object_type",
           "zeek.bacnet.instance_number",
@@ -522,7 +520,6 @@
         "columns": [
           "source.ip",
           "destination.ip",
-          "network.is_orig",
           "zeek.bacnet_discovery.pdu_service",
           "zeek.bacnet_discovery.object_type",
           "zeek.bacnet.instance_number",
diff --git a/dashboards/dashboards/e76d05c0-eb9f-11e9-a384-0fcf32210194.json b/dashboards/dashboards/e76d05c0-eb9f-11e9-a384-0fcf32210194.json
index 8e9e8ec31..523c02acd 100644
--- a/dashboards/dashboards/e76d05c0-eb9f-11e9-a384-0fcf32210194.json
+++ b/dashboards/dashboards/e76d05c0-eb9f-11e9-a384-0fcf32210194.json
@@ -359,7 +359,6 @@
           "source.port",
           "destination.ip",
           "destination.port",
-          "network.is_orig",
           "event.action",
           "event.result",
           "zeek.s7comm.pdu_reference",
@@ -400,7 +399,6 @@
           "source.port",
           "destination.ip",
           "destination.port",
-          "network.is_orig",
           "event.action",
           "event.result",
           "zeek.uid"
diff --git a/logstash/pipelines/zeek/11_zeek_parse.conf b/logstash/pipelines/zeek/11_zeek_parse.conf
index d0bfcdd10..5f84a1906 100644
--- a/logstash/pipelines/zeek/11_zeek_parse.conf
+++ b/logstash/pipelines/zeek/11_zeek_parse.conf
@@ -214,7 +214,7 @@ filter {
       id => "dissect_zeek_bacnet"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][bvlc_function]}	%{[zeek_cols][pdu_type]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][result_code]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][bvlc_function]}	%{[zeek_cols][pdu_type]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][result_code]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -225,7 +225,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bacnet"
-        init => "$zeek_bacnet_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'bvlc_function', 'pdu_type', 'pdu_service', 'invoke_id', 'result_code' ]"
+        init => "$zeek_bacnet_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'bvlc_function', 'pdu_type', 'pdu_service', 'invoke_id', 'result_code' ]"
         code => "event.set('[zeek_cols]', $zeek_bacnet_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -275,7 +275,7 @@ filter {
       id => "dissect_zeek_bsap_ip_header"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][num_msg]}	%{[zeek_cols][type_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][num_msg]}	%{[zeek_cols][type_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -286,7 +286,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bsap_ip_header"
-        init => "$zeek_bsap_ip_header_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'num_msg', 'type_name' ]"
+        init => "$zeek_bsap_ip_header_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'num_msg', 'type_name' ]"
         code => "event.set('[zeek_cols]', $zeek_bsap_ip_header_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -309,7 +309,7 @@ filter {
       id => "dissect_zeek_bsap_ip_rdb"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][header_size]}	%{[zeek_cols][mes_seq]}	%{[zeek_cols][res_seq]}	%{[zeek_cols][data_len]}	%{[zeek_cols][sequence]}	%{[zeek_cols][app_func_code]}	%{[zeek_cols][node_status]}	%{[zeek_cols][func_code]}	%{[zeek_cols][variable_count]}	%{[zeek_cols][variables]}	%{[zeek_cols][variable_value]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][header_size]}	%{[zeek_cols][mes_seq]}	%{[zeek_cols][res_seq]}	%{[zeek_cols][data_len]}	%{[zeek_cols][sequence]}	%{[zeek_cols][app_func_code]}	%{[zeek_cols][node_status]}	%{[zeek_cols][func_code]}	%{[zeek_cols][variable_count]}	%{[zeek_cols][variables]}	%{[zeek_cols][variable_value]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -320,7 +320,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bsap_ip_rdb"
-        init => "$zeek_bsap_ip_rdb_field_names = [ 'ts', 'uid', 'header_size', 'mes_seq', 'res_seq', 'data_len', 'sequence', 'app_func_code', 'node_status', 'func_code', 'variable_count', 'variables', 'variable_value' ]"
+        init => "$zeek_bsap_ip_rdb_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'header_size', 'mes_seq', 'res_seq', 'data_len', 'sequence', 'app_func_code', 'node_status', 'func_code', 'variable_count', 'variables', 'variable_value' ]"
         code => "event.set('[zeek_cols]', $zeek_bsap_ip_rdb_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -343,7 +343,7 @@ filter {
       id => "dissect_zeek_bsap_serial_header"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][ser]}	%{[zeek_cols][dadd]}	%{[zeek_cols][sadd]}	%{[zeek_cols][ctl]}	%{[zeek_cols][dfun]}	%{[zeek_cols][seq]}	%{[zeek_cols][sfun]}	%{[zeek_cols][nsb]}	%{[zeek_cols][type_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][ser]}	%{[zeek_cols][dadd]}	%{[zeek_cols][sadd]}	%{[zeek_cols][ctl]}	%{[zeek_cols][dfun]}	%{[zeek_cols][seq]}	%{[zeek_cols][sfun]}	%{[zeek_cols][nsb]}	%{[zeek_cols][type_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -354,7 +354,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bsap_serial_header"
-        init => "$zeek_bsap_serial_header_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'ser', 'dadd', 'sadd', 'ctl', 'dfun', 'seq', 'sfun', 'nsb', 'type_name' ]"
+        init => "$zeek_bsap_serial_header_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'ser', 'dadd', 'sadd', 'ctl', 'dfun', 'seq', 'sfun', 'nsb', 'type_name' ]"
         code => "event.set('[zeek_cols]', $zeek_bsap_serial_header_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -377,7 +377,7 @@ filter {
       id => "dissect_zeek_bsap_serial_rdb"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][func_code]}	%{[zeek_cols][variable_count]}	%{[zeek_cols][variables]}	%{[zeek_cols][variable_value]}"
+        "[message]"	=> "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][func_code]}	%{[zeek_cols][variable_count]}	%{[zeek_cols][variables]}	%{[zeek_cols][variable_value]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -388,7 +388,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bsap_serial_rdb"
-        init => "$zeek_bsap_serial_rdb_field_names = [ 'ts', 'uid', 'func_code', 'variable_count', 'variables', 'variable_value' ]"
+        init => "$zeek_bsap_serial_rdb_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'func_code', 'variable_count', 'variables', 'variable_value' ]"
         code => "event.set('[zeek_cols]', $zeek_bsap_serial_rdb_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -411,7 +411,7 @@ filter {
       id => "dissect_zeek_bsap_serial_rdb_ext"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][dfun]}	%{[zeek_cols][seq]}	%{[zeek_cols][sfun]}	%{[zeek_cols][nsb]}	%{[zeek_cols][extfun]}	%{[zeek_cols][data]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][dfun]}	%{[zeek_cols][seq]}	%{[zeek_cols][sfun]}	%{[zeek_cols][nsb]}	%{[zeek_cols][extfun]}	%{[zeek_cols][data]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -422,7 +422,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bsap_serial_rdb_ext"
-        init => "$zeek_bsap_serial_rdb_ext_field_names = [ 'ts', 'uid', 'dfun', 'seq', 'sfun', 'nsb', 'extfun', 'data' ]"
+        init => "$zeek_bsap_serial_rdb_ext_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'dfun', 'seq', 'sfun', 'nsb', 'extfun', 'data' ]"
         code => "event.set('[zeek_cols]', $zeek_bsap_serial_rdb_ext_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -451,7 +451,7 @@ filter {
       id => "dissect_zeek_bacnet_device_control"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][time_duration]}	%{[zeek_cols][device_state]}	%{[zeek_cols][password]}	%{[zeek_cols][result]}	%{[zeek_cols][result_code]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][time_duration]}	%{[zeek_cols][device_state]}	%{[zeek_cols][password]}	%{[zeek_cols][result]}	%{[zeek_cols][result_code]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -462,7 +462,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bacnet_device_control"
-        init => "$zeek_bacnet_device_control_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'invoke_id', 'pdu_service', 'time_duration', 'device_state', 'password', 'result', 'result_code' ]"
+        init => "$zeek_bacnet_device_control_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'invoke_id', 'pdu_service', 'time_duration', 'device_state', 'password', 'result', 'result_code' ]"
         code => "event.set('[zeek_cols]', $zeek_bacnet_device_control_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -485,7 +485,7 @@ filter {
       id => "dissect_zeek_bacnet_discovery"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][object_type]}	%{[zeek_cols][instance_number]}	%{[zeek_cols][vendor]}	%{[zeek_cols][range]}	%{[zeek_cols][object_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][object_type]}	%{[zeek_cols][instance_number]}	%{[zeek_cols][vendor]}	%{[zeek_cols][range]}	%{[zeek_cols][object_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -496,7 +496,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bacnet_discovery"
-        init => "$zeek_bacnet_discovery_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'pdu_service', 'object_type', 'instance_number', 'vendor', 'range', 'object_name' ]"
+        init => "$zeek_bacnet_discovery_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'pdu_service', 'object_type', 'instance_number', 'vendor', 'range', 'object_name' ]"
         code => "event.set('[zeek_cols]', $zeek_bacnet_discovery_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -519,7 +519,7 @@ filter {
       id => "dissect_zeek_bacnet_property"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][object_type]}	%{[zeek_cols][instance_number]}	%{[zeek_cols][property]}	%{[zeek_cols][array_index]}	%{[zeek_cols][value]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][invoke_id]}	%{[zeek_cols][pdu_service]}	%{[zeek_cols][object_type]}	%{[zeek_cols][instance_number]}	%{[zeek_cols][property]}	%{[zeek_cols][array_index]}	%{[zeek_cols][value]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -530,7 +530,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_bacnet_property"
-        init => "$zeek_bacnet_property_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'invoke_id', 'pdu_service', 'object_type', 'instance_number', 'property', 'array_index', 'value' ]"
+        init => "$zeek_bacnet_property_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'invoke_id', 'pdu_service', 'object_type', 'instance_number', 'property', 'array_index', 'value' ]"
         code => "event.set('[zeek_cols]', $zeek_bacnet_property_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -555,7 +555,7 @@ filter {
       id => "dissect_zeek_cip"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][cip_sequence_count]}	%{[zeek_cols][direction]}	%{[zeek_cols][cip_service_code]}	%{[zeek_cols][cip_service]}	%{[zeek_cols][cip_status_code]}	%{[zeek_cols][cip_status]}	%{[zeek_cols][cip_extended_status_code]}	%{[zeek_cols][cip_extended_status]}	%{[zeek_cols][class_id]}	%{[zeek_cols][class_name]}	%{[zeek_cols][instance_id]}	%{[zeek_cols][attribute_id]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][cip_sequence_count]}	%{[zeek_cols][direction]}	%{[zeek_cols][cip_service_code]}	%{[zeek_cols][cip_service]}	%{[zeek_cols][cip_status_code]}	%{[zeek_cols][cip_status]}	%{[zeek_cols][cip_extended_status_code]}	%{[zeek_cols][cip_extended_status]}	%{[zeek_cols][class_id]}	%{[zeek_cols][class_name]}	%{[zeek_cols][instance_id]}	%{[zeek_cols][attribute_id]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -566,7 +566,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_cip"
-        init => "$zeek_cip_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'cip_sequence_count', 'direction', 'cip_service_code', 'cip_service', 'cip_status_code', 'cip_status', 'cip_extended_status_code', 'cip_extended_status', 'class_id', 'class_name', 'instance_id', 'attribute_id' ]"
+        init => "$zeek_cip_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'cip_sequence_count', 'direction', 'cip_service_code', 'cip_service', 'cip_status_code', 'cip_status', 'cip_extended_status_code', 'cip_extended_status', 'class_id', 'class_name', 'instance_id', 'attribute_id' ]"
         code => "event.set('[zeek_cols]', $zeek_cip_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -588,7 +588,7 @@ filter {
       id => "dissect_zeek_cip_identity"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][encapsulation_version]}	%{[zeek_cols][socket_address]}	%{[zeek_cols][socket_port]}	%{[zeek_cols][vendor_id]}	%{[zeek_cols][vendor_name]}	%{[zeek_cols][device_type_id]}	%{[zeek_cols][device_type_name]}	%{[zeek_cols][product_code]}	%{[zeek_cols][revision]}	%{[zeek_cols][device_status]}	%{[zeek_cols][serial_number]}	%{[zeek_cols][product_name]}	%{[zeek_cols][device_state]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][encapsulation_version]}	%{[zeek_cols][socket_address]}	%{[zeek_cols][socket_port]}	%{[zeek_cols][vendor_id]}	%{[zeek_cols][vendor_name]}	%{[zeek_cols][device_type_id]}	%{[zeek_cols][device_type_name]}	%{[zeek_cols][product_code]}	%{[zeek_cols][revision]}	%{[zeek_cols][device_status]}	%{[zeek_cols][serial_number]}	%{[zeek_cols][product_name]}	%{[zeek_cols][device_state]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -599,7 +599,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_cip_identity"
-        init => "$zeek_cip_identity_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'encapsulation_version', 'socket_address', 'socket_port', 'vendor_id', 'vendor_name', 'device_type_id', 'device_type_name', 'product_code', 'device_status', 'serial_number', 'product_name', 'device_state' ]"
+        init => "$zeek_cip_identity_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'encapsulation_version', 'socket_address', 'socket_port', 'vendor_id', 'vendor_name', 'device_type_id', 'device_type_name', 'product_code', 'device_status', 'serial_number', 'product_name', 'device_state' ]"
         code => "event.set('[zeek_cols]', $zeek_cip_identity_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -620,7 +620,7 @@ filter {
       id => "dissect_zeek_cip_io"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][connection_id]}	%{[zeek_cols][sequence_number]}	%{[zeek_cols][data_length]}	%{[zeek_cols][io_data]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][connection_id]}	%{[zeek_cols][sequence_number]}	%{[zeek_cols][data_length]}	%{[zeek_cols][io_data]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -631,7 +631,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_cip_io"
-        init => "$zeek_cip_io_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'connection_id', 'sequence_number', 'data_length', 'io_data' ]"
+        init => "$zeek_cip_io_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'connection_id', 'sequence_number', 'data_length', 'io_data' ]"
         code => "event.set('[zeek_cols]', $zeek_cip_io_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -805,7 +805,7 @@ filter {
       id => "dissect_zeek_dnp3_control"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][block_type]}	%{[zeek_cols][function_code]}	%{[zeek_cols][index_number]}	%{[zeek_cols][trip_control_code]}	%{[zeek_cols][operation_type]}	%{[zeek_cols][execute_count]}	%{[zeek_cols][on_time]}	%{[zeek_cols][off_time]}	%{[zeek_cols][status_code]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][block_type]}	%{[zeek_cols][function_code]}	%{[zeek_cols][index_number]}	%{[zeek_cols][trip_control_code]}	%{[zeek_cols][operation_type]}	%{[zeek_cols][execute_count]}	%{[zeek_cols][on_time]}	%{[zeek_cols][off_time]}	%{[zeek_cols][status_code]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -816,7 +816,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_dnp3_control"
-        init => "$zeek_dnp3_control_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'block_type', 'function_code', 'index_number', 'trip_control_code', 'operation_type', 'execute_count', 'on_time', 'off_time', 'status_code' ]"
+        init => "$zeek_dnp3_control_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'block_type', 'function_code', 'index_number', 'trip_control_code', 'operation_type', 'execute_count', 'on_time', 'off_time', 'status_code' ]"
         code => "event.set('[zeek_cols]', $zeek_dnp3_control_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -836,7 +836,7 @@ filter {
       id => "dissect_zeek_dnp3_objects"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][function_code]}	%{[zeek_cols][object_type]}	%{[zeek_cols][object_count]}	%{[zeek_cols][range_low]}	%{[zeek_cols][range_high]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][function_code]}	%{[zeek_cols][object_type]}	%{[zeek_cols][object_count]}	%{[zeek_cols][range_low]}	%{[zeek_cols][range_high]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -847,7 +847,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_dnp3_objects"
-        init => "$zeek_dnp3_objects_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'function_code', 'object_type', 'object_count', 'range_low', 'range_high' ]"
+        init => "$zeek_dnp3_objects_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'function_code', 'object_type', 'object_count', 'range_low', 'range_high' ]"
         code => "event.set('[zeek_cols]', $zeek_dnp3_objects_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -942,7 +942,7 @@ filter {
       id => "dissect_zeek_enip"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][enip_command_code]}	%{[zeek_cols][enip_command]}	%{[zeek_cols][length]}	%{[zeek_cols][session_handle]}	%{[zeek_cols][enip_status]}	%{[zeek_cols][sender_context]}	%{[zeek_cols][options]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][enip_command_code]}	%{[zeek_cols][enip_command]}	%{[zeek_cols][length]}	%{[zeek_cols][session_handle]}	%{[zeek_cols][enip_status]}	%{[zeek_cols][sender_context]}	%{[zeek_cols][options]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -953,7 +953,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_enip"
-        init => "$zeek_enip_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'enip_command', 'length', 'session_handle', 'enip_status', 'sender_context', 'options' ]"
+        init => "$zeek_enip_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'enip_command', 'length', 'session_handle', 'enip_status', 'sender_context', 'options' ]"
         code => "event.set('[zeek_cols]', $zeek_enip_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -1623,7 +1623,7 @@ filter {
       id => "dissect_zeek_cotp"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][pdu_code]}	%{[zeek_cols][pdu_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][pdu_code]}	%{[zeek_cols][pdu_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -1634,7 +1634,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_cotp"
-        init => "$zeek_cotp_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'pdu_code', 'pdu_name' ]"
+        init => "$zeek_cotp_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'pdu_code', 'pdu_name' ]"
         code => "event.set('[zeek_cols]', $zeek_cotp_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -1938,7 +1938,7 @@ filter {
       id => "dissect_zeek_modbus_detailed"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][address]}	%{[zeek_cols][quantity]}	%{[zeek_cols][values]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][address]}	%{[zeek_cols][quantity]}	%{[zeek_cols][values]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -1949,7 +1949,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_modbus_detailed"
-        init => "$zeek_modbus_detailed_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'address', 'quantity', 'values' ]"
+        init => "$zeek_modbus_detailed_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'address', 'quantity', 'values' ]"
         code => "event.set('[zeek_cols]', $zeek_modbus_detailed_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -1969,7 +1969,7 @@ filter {
       id => "dissect_zeek_modbus_mask_write_register"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][address]}	%{[zeek_cols][and_mask]}	%{[zeek_cols][or_mask]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][address]}	%{[zeek_cols][and_mask]}	%{[zeek_cols][or_mask]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -1980,7 +1980,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_modbus_mask_write_register"
-        init => "$zeek_modbus_mask_write_register_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'address', 'and_mask', 'or_mask' ]"
+        init => "$zeek_modbus_mask_write_register_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'address', 'and_mask', 'or_mask' ]"
         code => "event.set('[zeek_cols]', $zeek_modbus_modbus_mask_write_register_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -1999,7 +1999,7 @@ filter {
       id => "dissect_zeek_modbus_read_write_multiple_registers"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][write_start_address]}	%{[zeek_cols][write_registers]}	%{[zeek_cols][read_start_address]}	%{[zeek_cols][read_quantity]}	%{[zeek_cols][read_registers]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][unit_id]}	%{[zeek_cols][func]}	%{[zeek_cols][network_direction]}	%{[zeek_cols][write_start_address]}	%{[zeek_cols][write_registers]}	%{[zeek_cols][read_start_address]}	%{[zeek_cols][read_quantity]}	%{[zeek_cols][read_registers]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -2010,7 +2010,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_modbus_read_write_multiple_registers"
-        init => "$zeek_modbus_read_write_multiple_registers_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'write_start_address', 'write_registers', 'read_start_address', 'read_quantity', 'read_registers' ]"
+        init => "$zeek_modbus_read_write_multiple_registers_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'unit_id', 'func', 'network_direction', 'write_start_address', 'write_registers', 'read_start_address', 'read_quantity', 'read_registers' ]"
         code => "event.set('[zeek_cols]', $zeek_modbus_read_write_multiple_registers_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -2549,7 +2549,7 @@ filter {
       id => "dissect_zeek_s7comm"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][rosctr_code]}	%{[zeek_cols][rosctr_name]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][function_code]}	%{[zeek_cols][function_name]}	%{[zeek_cols][subfunction_code]}	%{[zeek_cols][subfunction_name]}	%{[zeek_cols][error_class]}	%{[zeek_cols][error_code]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][rosctr_code]}	%{[zeek_cols][rosctr_name]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][function_code]}	%{[zeek_cols][function_name]}	%{[zeek_cols][subfunction_code]}	%{[zeek_cols][subfunction_name]}	%{[zeek_cols][error_class]}	%{[zeek_cols][error_code]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -2560,7 +2560,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_s7comm"
-        init => "$zeek_s7comm_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'rosctr_code', 'rosctr_name', 'pdu_reference', 'function_code', 'function_name', 'subfunction_code', 'subfunction_name', 'error_class', 'error_code' ]"
+        init => "$zeek_s7comm_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'rosctr_code', 'rosctr_name', 'pdu_reference', 'function_code', 'function_name', 'subfunction_code', 'subfunction_name', 'error_class', 'error_code' ]"
         code => "event.set('[zeek_cols]', $zeek_s7comm_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -2583,7 +2583,7 @@ filter {
       id => "dissect_zeek_s7comm_plus"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][version]}	%{[zeek_cols][opcode]}	%{[zeek_cols][opcode_name]}	%{[zeek_cols][function_code]}	%{[zeek_cols][function_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][version]}	%{[zeek_cols][opcode]}	%{[zeek_cols][opcode_name]}	%{[zeek_cols][function_code]}	%{[zeek_cols][function_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -2594,7 +2594,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_s7comm_plus"
-        init => "$zeek_s7comm_plus_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'is_orig', 'version', 'opcode', 'opcode_name', 'function_code', 'function_name' ]"
+        init => "$zeek_s7comm_plus_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'version', 'opcode', 'opcode_name', 'function_code', 'function_name' ]"
         code => "event.set('[zeek_cols]', $zeek_s7comm_plus_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -2617,7 +2617,7 @@ filter {
       id => "dissect_zeek_s7comm_read_szl"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][method]}	%{[zeek_cols][szl_id]}	%{[zeek_cols][szl_id_name]}	%{[zeek_cols][szl_index]}	%{[zeek_cols][return_code]}	%{[zeek_cols][return_code_name]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][method]}	%{[zeek_cols][szl_id]}	%{[zeek_cols][szl_id_name]}	%{[zeek_cols][szl_index]}	%{[zeek_cols][return_code]}	%{[zeek_cols][return_code_name]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -2628,7 +2628,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_s7comm_read_szl"
-        init => "$zeek_s7comm_read_szl_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'pdu_reference', 'method', 'szl_id', 'szl_id_name', 'szl_index', 'return_code', 'return_code_name' ]"
+        init => "$zeek_s7comm_read_szl_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'pdu_reference', 'method', 'szl_id', 'szl_id_name', 'szl_index', 'return_code', 'return_code_name' ]"
         code => "event.set('[zeek_cols]', $zeek_s7comm_read_szl_field_names.zip(event.get('[message]')).to_h)"
       }
     }
@@ -2651,7 +2651,7 @@ filter {
       id => "dissect_zeek_s7comm_upload_download"
       # zeek's default delimiter is a literal tab, MAKE SURE YOUR EDITOR DOESN'T SCREW IT UP
       mapping => {
-        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][rosctr_name]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][function_name]}	%{[zeek_cols][function_status]}	%{[zeek_cols][session_id]}	%{[zeek_cols][blocklength]}	%{[zeek_cols][filename]}	%{[zeek_cols][block_type]}	%{[zeek_cols][block_number]}	%{[zeek_cols][destination_filesystem]}"
+        "[message]" => "%{[zeek_cols][ts]}	%{[zeek_cols][uid]}	%{[zeek_cols][drop_orig_h]}	%{[zeek_cols][drop_orig_p]}	%{[zeek_cols][drop_resp_h]}	%{[zeek_cols][drop_resp_p]}	%{[zeek_cols][is_orig]}	%{[zeek_cols][orig_h]}	%{[zeek_cols][orig_p]}	%{[zeek_cols][resp_h]}	%{[zeek_cols][resp_p]}	%{[zeek_cols][rosctr_name]}	%{[zeek_cols][pdu_reference]}	%{[zeek_cols][function_name]}	%{[zeek_cols][function_status]}	%{[zeek_cols][session_id]}	%{[zeek_cols][blocklength]}	%{[zeek_cols][filename]}	%{[zeek_cols][block_type]}	%{[zeek_cols][block_number]}	%{[zeek_cols][destination_filesystem]}"
       }
     }
     if ("_dissectfailure" in [tags]) {
@@ -2662,7 +2662,7 @@ filter {
       }
       ruby {
         id => "ruby_zip_zeek_s7comm_upload_download"
-        init => "$zeek_s7comm_upload_download_field_names = [ 'ts', 'uid', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'rosctr_name', 'pdu_reference', 'function_name', 'function_status', 'session_id', 'blocklength', 'filename', 'block_type', 'block_number', 'destination_filesystem' ]"
+        init => "$zeek_s7comm_upload_download_field_names = [ 'ts', 'uid', 'drop_orig_h', 'drop_orig_p', 'drop_resp_h', 'drop_resp_p', 'is_orig', 'orig_h', 'orig_p', 'resp_h', 'resp_p', 'rosctr_name', 'pdu_reference', 'function_name', 'function_status', 'session_id', 'blocklength', 'filename', 'block_type', 'block_number', 'destination_filesystem' ]"
         code => "event.set('[zeek_cols]', $zeek_s7comm_upload_download_field_names.zip(event.get('[message]')).to_h)"
       }
     }
diff --git a/logstash/pipelines/zeek/12_zeek_mutate.conf b/logstash/pipelines/zeek/12_zeek_mutate.conf
index ad3bc4873..1ae4e31cb 100644
--- a/logstash/pipelines/zeek/12_zeek_mutate.conf
+++ b/logstash/pipelines/zeek/12_zeek_mutate.conf
@@ -41,6 +41,15 @@ filter {
     rename => { "[zeek][%{[log_source]}][community_id]"    => "[network][community_id]" }
   }
 
+  # we'll just save the "true" source and destination fields.
+  #   see, for example, https://github.com/cisagov/icsnpp-bacnet#source-and-destination-fields
+  mutate { id => "mutate_remove_zeek_common_fields"
+           remove_field => [
+            "[zeek][%{[log_source]}][drop_orig_h]",
+            "[zeek][%{[log_source]}][drop_orig_p]",
+            "[zeek][%{[log_source]}][drop_resp_h]",
+            "[zeek][%{[log_source]}][drop_resp_p]" ] }
+
   # create a repeatable fingerprint for document ID
   fingerprint {
     id => "fingerprint_zeek_event_hash"