1300_zeek_normalize.conf

# Copyright (c) 2025 Battelle Energy Alliance, LLC.  All rights reserved.

filter {

  # most Zeek intel stuff maps to ecs-threat
  #   https://www.elastic.co/guide/en/ecs/current/ecs-threat.html
  if ([zeek][intel]) {

    # map confidence (0-1) to Low/Medium/High/None
    if ([zeek][intel][cif_confidence]) {
      ruby {
        id => "ruby_map_zeek_intel_confidence"
        code => "
          if (confNumVal = event.get('[zeek][intel][cif_confidence]').to_f) then
            confStrVal = case confNumVal
              when 0...3
                'Low'
              when 3...7
                'Medium'
              when 7...10
                'High'
              else
                'None'
              end
            event.set('[threat][indicator][confidence]', confStrVal)
          end"
      }
    }

    # normalize indicator type and indicator value for ECS
    if ([zeek][intel][seen_indicator_type]) {

      # store indicator value in ECS-mapped fields
      if ([zeek][intel][seen_indicator]) {

        if ([zeek][intel][seen_indicator_type] == "Intel::ADDR") {
          # ECS - ADDR-type intel indicators to related.ip
          mutate { id => "mutate_merge_field_related_ip_zeek_intel_addr"
                   merge => { "[related][ip]" => "[zeek][intel][seen_indicator]" } }
          # determine if the seen indicator is ipv4 or ipv6
          cidr {
            id      => "cidr_detect_network_type_ipv4_source"
            add_field => { "[@metadata][intel_indicator_ip_type]" => "Intel::ADDR4" }
            address => [ "%{[zeek][intel][seen_indicator]}" ]
            network => [ "0.0.0.0/0" ]
          }
          if (![@metadata][intel_indicator_ip_type]) {
            mutate { id => "cidr_detect_network_type_ipv6_source"
                     add_field => { "[@metadata][intel_indicator_ip_type]" => "Intel::ADDR6" } }
          }
          mutate { id => "mutate_replace_zeek_intel_addr_indicator_type"
                   replace => { "[zeek][intel][seen_indicator_type]" => "%{[@metadata][intel_indicator_ip_type]}" } }

        } else if ([zeek][intel][seen_indicator_type] == "Intel::URL") {
          # ECS - URL-type intel indicators to url.original
          if (![url][original]) {
            mutate { id => "mutate_merge_field_related_ip_zeek_intel_url"
                     merge => { "[url][original]" => "[zeek][intel][seen_indicator]" } }
          }

        } else if ([zeek][intel][seen_indicator_type] == "Intel::DOMAIN") {
          # ECS - DOMAIN-type intel indicators to related.hosts
          mutate { id => "mutate_merge_field_related_ip_zeek_intel_domain"
                   merge => { "[related][hosts]" => "[zeek][intel][seen_indicator]" } }

        } else if ([zeek][intel][seen_indicator_type] == "Intel::USER_NAME") {
          # ECS - USER_NAME-type intel indicators to related.user
          mutate { id => "mutate_merge_field_related_ip_zeek_intel_user"
                   merge => { "[related][user]" => "[zeek][intel][seen_indicator]" } }

        } else if ([zeek][intel][seen_indicator_type] == "Intel::FILE_HASH") {
          # ECS - FILE_HASH-type intel indicators to related.hash
          mutate { id => "mutate_merge_field_related_ip_zeek_intel_hash"
                   merge => { "[related][hash]" => "[zeek][intel][seen_indicator]" } }

        } else if ([zeek][intel][seen_indicator_type] == "Intel::FILE_NAME") {
          # ECS - FILE_NAME-type intel indicators to file.path
          if (![file][path]) {
            mutate { id => "mutate_merge_field_related_ip_zeek_intel_file_name"
                     merge => { "[file][path]" => "[zeek][intel][seen_indicator]" } }
          }
        }

        mutate { id => "mutate_suricata_rename_zeek_intel_seen_indicator"
                 rename => { "[zeek][intel][seen_indicator]" => "[threat][indicator][name]" } }
      } # seen_indicator

      # map zeek intel indicator type from seen.indicator_type to ECS-specified values
      #   https://www.elastic.co/guide/en/ecs/current/ecs-threat.html#field-threat-enrichments-indicator-type
      translate {
        id => "translate_intel_seen_indicator_type_seen"
        source => "[zeek][intel][seen_indicator_type]"
        target => "[@metadata][intel_indicator_type_seen]"
        dictionary_path => "/etc/zeek_intel_indicator_types.yaml"
        remove_field => [ "[zeek][intel][seen_indicator_type]" ]
      }

    } # seen_indicator_type

    if ([zeek][intel][matched]) {
      # map zeek intel indicator type from seen.matched to ECS-specified values
      #   https://www.elastic.co/guide/en/ecs/current/ecs-threat.html#field-threat-enrichments-indicator-type
      translate {
        id => "translate_intel_seen_indicator_types_seen"
        iterate_on => "[zeek][intel][matched]"
        source => "[zeek][intel][matched]"
        target => "[@metadata][intel_indicator_types_matched]"
        dictionary_path => "/etc/zeek_intel_indicator_types.yaml"
        remove_field => [ "[zeek][intel][matched]" ]
      }
    }

    # merge indicator types found above to threat.indicator.type
    if ([@metadata][intel_indicator_type_seen]) {
      mutate { id => "mutate_merge_zeek_intel_indicator_type_seen"
               merge => { "[threat][indicator][type]" => "[@metadata][intel_indicator_type_seen]" } }
    }
    if ([@metadata][intel_indicator_types_matched]) {
      mutate { id => "mutate_merge_zeek_intel_indicator_types_matched"
               merge => { "[threat][indicator][type]" => "[@metadata][intel_indicator_types_matched]" } }
    }
    if ([threat][indicator][type]) {
      ruby {
        id => "ruby_threat_indicator_type_uniq"
        path => "/usr/share/logstash/malcolm-ruby/make_unique_array.rb"
        script_params => {
          "field" => "[threat][indicator][type]"
        }
      }
    }

    # zeek.intel.sources -> threat.indicator.provider
    if ([zeek][intel][sources]) {
      mutate { id => "mutate_merge_zeek_intel_sources"
               merge => { "[threat][indicator][provider]" => "[zeek][intel][sources]" }
               remove_field => [ "[zeek][intel][sources]" ] }
    }
    # zeek.intel.cif_source -> threat.indicator.provider
    if ([zeek][intel][cif_source]) {
      mutate { id => "mutate_merge_zeek_intel_cif_source"
               merge => { "[threat][indicator][provider]" => "[zeek][intel][cif_source]" }
               remove_field => [ "[zeek][intel][cif_source]" ] }
    }
    # zeek.intel.cif_tags -> tags
    if ([zeek][intel][cif_tags]) {
      mutate { id => "mutate_merge_zeek_intel_cif_tags"
               merge => { "[tags]" => "[zeek][intel][cif_tags]" }
               remove_field => [ "[zeek][intel][cif_tags]" ] }
    }
    # zeek.intel.cif_description -> threat.indicator.description
    if ([zeek][intel][cif_description]) {
      mutate { id => "mutate_suricata_rename_zeek_intel_cif_description"
               rename => { "[zeek][intel][cif_description]" => "[threat][indicator][description]" } }
    }

    if ([zeek][intel][seen_where] =~ /^(DNS|HTTP|SMTP|SSL|SSH|SMB|X509)::/) and (![network][protocol]) {
      # use zeel.intel.seen_where to map to service
      #   https://docs.zeek.org/en/master/scripts/base/frameworks/intel/main.zeek.html#type-Intel::Wheres
      grok {
        id => "grok_zeek_intel_seen_where"
        match => { "[zeek][intel][seen_where]" => [ "^%{DATA:[@metadata][intel_seen_where]}::%{GREEDYDATA:[@metadata][intel_seen_where_sub]}$" ] }
      }
      if ([@metadata][intel_seen_where]) {
        translate {
          id => "translate_zeek_intel_seen_where"
          source => "[@metadata][intel_seen_where]"
          target => "[network][protocol]"
          dictionary => {
            "DNS" => "dns"
            "HTTP" => "http"
            "SMTP" => "smtp"
            "SSL" => "tls"
            "SSH" => "ssh"
            "SMB" => "smb"
            "X509" => "X.509"
          }
          fallback => "%{[@metadata][intel_seen_where]}"
        }
      }
    }
  } # zeek intel

  # Protocol/service version ##########################################################################################
  # collect protocol version under the parent network.protocol_version array

  if ([zeek][gquic][version])                    { mutate { id => "mutate_merge_normalize_zeek_gquic_version"
                                                            merge => { "[network][protocol_version]" => "[zeek][gquic][version]" } } }

  if ([zeek][http][version])                     { mutate { id => "mutate_merge_normalize_zeek_http_version"
                                                            merge => { "[network][protocol_version]" => "[zeek][http][version]" } } }

  if ([zeek][hart_ip][header_version])           { mutate { id => "mutate_merge_normalize_zeek_hart_ip_version"
                                                            merge => { "[network][protocol_version]" => "[zeek][hart_ip][header_version]" } } }

  if ([zeek][hart_ip_universal_commands][read_unique_identifier_response_hart_protocol_major_revision]) {
    mutate { id => "mutate_merge_normalize_zeek_hart_ip_universal_commands_read_unique_identifier_response_hart_protocol_major_revision"
             merge => { "[network][protocol_version]" => "[zeek][hart_ip_universal_commands][read_unique_identifier_response_hart_protocol_major_revision]" } } }

  if ([zeek][ipsec]) {
    ruby {
      id => "ruby_zeek_field_network_protocol_version_ipsec"
      code => "
        versions = Array.new
        versions << [event.get('[zeek][ipsec][maj_ver]').to_s,
                     event.get('[zeek][ipsec][min_ver]').to_s].reject{ |e| e.nil? || e&.empty? }.join('.')
        event.set('[network][protocol_version]', versions)"
    }
  }

  if ([zeek][ldap][version])                      { mutate { id => "mutate_merge_normalize_zeek_ldap_version"
                                                            merge => { "[network][protocol_version]" => "[zeek][ldap][version]" } } }

  if ([zeek][ntp][version])                       { mutate { id => "mutate_merge_normalize_zeek_ntp_version"
                                                            merge => { "[network][protocol_version]" => "[zeek][ntp][version]" } } }

  if ([zeek][opcua_binary][version])              { mutate { id => "mutate_merge_normalize_zeek_opcua_binary_version"
                                                             merge => { "[network][protocol_version]" => "[zeek][opcua_binary][version]" } } }

  if ([zeek][opcua_binary_browse][browse_view_description_view_version]) {
                                                    mutate { id => "mutate_merge_normalize_zeek_opcua_binary_browse_browse_view_description_view_version"
                                                             merge => { "[network][protocol_version]" => "[zeek][opcua_binary_browse][browse_view_description_view_version]" } } }

  if ([zeek][opcua_binary_opensecure_channel][client_proto_ver])  { mutate { id => "mutate_merge_normalize_zeek_opcua_binary_opensecure_channel_client_proto_version"
                                                                             merge => { "[network][protocol_version]" => "[zeek][opcua_binary_opensecure_channel][client_proto_ver]" } } }

  if ([zeek][opcua_binary_opensecure_channel][server_proto_ver])  { mutate { id => "mutate_merge_normalize_opcua_binary_opensecure_channel_server_proto_version"
                                                                             merge => { "[network][protocol_version]" => "[zeek][opcua_binary_opensecure_channel][server_proto_ver]" } } }

  if ([zeek][ospf][version])                      { mutate { id => "mutate_merge_normalize_zeek_ospf_version"
                                                             merge => { "[network][protocol_version]" => "[zeek][ospf][version]" } } }

  if ([zeek][profinet][block_version])            { mutate { id => "mutate_merge_normalize_zeek_profinet_block_version"
                                                              merge => { "[network][protocol_version]" => "[zeek][profinet][block_version]" } } }

  if ([zeek][profinet_dce_rpc][version])          { mutate { id => "mutate_merge_normalize_zeek_profinet_dce_rpc_version"
                                                             merge => { "[network][protocol_version]" => "[zeek][profinet_dce_rpc][version]" } } }

  if ([zeek][profinet_io_cm][rpc_version])        { mutate { id => "mutate_merge_normalize_zeek_profinet_io_cm_rpc_version"
                                                             merge => { "[network][protocol_version]" => "[zeek][profinet_io_cm][rpc_version]" } } }

  if ([zeek][rfb]) {
    ruby {
      id => "ruby_zeek_field_network_protocol_version_rfb"
      code => '
        versions = Array.new
        clientMajorVersion = event.get("[zeek][rfb][client_major_version]").sub!(/^0*/, "")
        clientMinorVersion = event.get("[zeek][rfb][client_minor_version]").sub!(/^0*/, "")
        serverMajorVersion = event.get("[zeek][rfb][server_major_version]").sub!(/^0*/, "")
        serverMinorVersion = event.get("[zeek][rfb][server_minor_version]").sub!(/^0*/, "")
        if clientMajorVersion then
          versions << [clientMajorVersion, clientMinorVersion].join(".")
        end
        if serverMajorVersion then
          versions << [serverMajorVersion, serverMinorVersion].join(".")
        end
        event.set("[network][protocol_version]", versions.uniq)'
    }
  }

  if ([zeek][rdp][client_build])                 { mutate { id => "mutate_merge_normalize_zeek_rdp_client_build"
                                                           merge => { "[network][protocol_version]" => "[zeek][rdp][client_build]" } } }

  if ([zeek][s7comm_plus][version])              { mutate { id => "mutate_merge_normalize_zeek_s7comm_plus_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][s7comm_plus][version]" } } }

  if ([zeek][smb_cmd][version])                  { mutate { id => "mutate_merge_normalize_zeek_smb_cmd_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][smb_cmd][version]" } } }

  if ([zeek][snmp][version])                     { mutate { id => "mutate_merge_normalize_zeek_snmp_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][snmp][version]" } } }

  if ([zeek][socks][version])                    { mutate { id => "mutate_merge_normalize_zeek_socks_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][socks][version]" } } }

  if ([zeek][ssh][version])                      { mutate { id => "mutate_merge_normalize_zeek_ssh_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][ssh][version]" } } }

  if ([zeek][ssl][ssl_version])                  { mutate { id => "mutate_merge_normalize_zeek_ssl_ssl_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][ssl][ssl_version]" } } }

  if ([zeek][synchrophasor][version])            { mutate { id => "mutate_merge_normalize_zeek_synchrophasor_version"
                                                           merge => { "[network][protocol_version]" => "[zeek][synchrophasor][version]" } } }

  # Action ############################################################################################################
  # collect all actions/operations/commands under the parent [event][action] array

  if ([zeek][bacnet_device_control]) {
    ruby {
      # action = pdu_service:device_state
      id => "ruby_zeek_bacnet_device_control_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        actions.append([event.get('[zeek][bacnet][pdu_service]'),
                        event.get('[zeek][bacnet_device_control][device_state]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][action]', actions)"
    }
  } else if ([zeek][bacnet][pdu_service]) {
    mutate { id => "mutate_merge_normalize_zeek_bacnet_pdu_service"
             merge => { "[event][action]" => "[zeek][bacnet][pdu_service]" } }
  } else if ([zeek][bacnet][bvlc_function]) and
            # e.g., "BVLC_Result" and "Unknown BVLC Function Code-0x0c" which aren't really "actions"
            ([zeek][bacnet][bvlc_function] !~ "BVLC") {
    mutate { id => "mutate_merge_normalize_zeek_bacnet_bvlc_function"
             merge => { "[event][action]" => "[zeek][bacnet][bvlc_function]" } }
  }

  if ([zeek][bsap_ip_header][type_name])          { mutate { id => "mutate_merge_normalize_zeek_bsap_ip_header_type_name"
                                                             merge => { "[event][action]" => "[zeek][bsap_ip_header][type_name]" } } }

  if ([zeek][bsap_ip_rdb]) {
    ruby {
      # action = zeek_bsap_ip_rdb.app_func_code:zeek_bsap_ip_rdb.func_code
      id => "ruby_zeek_bsap_ip_rdb_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        actions.append([event.get('[zeek][bsap_ip_rdb][app_func_code]'),
                        event.get('[zeek][bsap_ip_rdb][func_code]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][action]', actions)"
    }
  }

  if ([zeek][bsap_serial_header][sfun])          { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_header_sfun"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_header][sfun]" } } }

  if ([zeek][bsap_serial_header][dfun])          { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_header_dfun"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_header][dfun]" } } }

  if ([zeek][bsap_serial_rdb][func_code])        { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_rdb_func_code"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_rdb][func_code]" } } }

  if ([zeek][bsap_serial_rdb_ext][sfun])         { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_rdb_ext_sfun"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_rdb_ext][sfun]" } } }

  if ([zeek][bsap_serial_rdb_ext][dfun])         { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_rdb_ext_dfun"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_rdb_ext][dfun]" } } }

  if ([zeek][bsap_serial_rdb_ext][extfun])       { mutate { id => "mutate_merge_normalize_zeek_bsap_serial_rdb_ext_extfun"
                                                           merge => { "[event][action]" => "[zeek][bsap_serial_rdb_ext][extfun]" } } }

  if ([zeek][cip][cip_service])                  { mutate { id => "mutate_merge_normalize_zeek_cip_cip_service"
                                                           merge => { "[event][action]" => "[zeek][cip][cip_service]" } } }

  if ([zeek][dce_rpc][operation])                { mutate { id => "mutate_merge_normalize_zeek_dce_rpc_operation"
                                                           merge => { "[event][action]" => "[zeek][dce_rpc][operation]" } } }

  if ([zeek][dhcp][msg_types])                   { mutate { id => "mutate_merge_normalize_zeek_dhcp_msg_types"
                                                           merge => { "[event][action]" => "[zeek][dhcp][msg_types]" } } }

  if ([zeek][dnp3][fc_request])                  { mutate { id => "mutate_merge_normalize_zeek_dnp3_fc_request"
                                                           merge => { "[event][action]" => "[zeek][dnp3][fc_request]" } } }

  if ([zeek][dnp3_control]) {
    ruby {
      # action = function_code:operation_type:trip_control_code
      id => "ruby_zeek_dnp3_control_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        actions.append([event.get('[zeek][dnp3_control][function_code]'),
                        event.get('[zeek][dnp3_control][operation_type]'),
                        event.get('[zeek][dnp3_control][trip_control_code]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][action]', actions)"
    }
  }

  if ([zeek][dnp3_objects][function_code])  { mutate { id => "mutate_merge_normalize_zeek_dnp3_objects"
                                                       merge => { "[event][action]" => "[zeek][dnp3_objects][function_code]" } } }

  if ([zeek][dns]) {
    # action: query class and type
    if ([zeek][dns][qclass_name]) and ([zeek][dns][qtype_name]) {
      mutate { id => "mutate_add_field_metadata_dns_class_and_type"
               add_field => { "[@metadata][dns_action]" => "%{[zeek][dns][qclass_name]} %{[zeek][dns][qtype_name]}" } }
    } else if ([zeek][dns][qclass_name]) {
      mutate { id => "mutate_add_field_metadata_dns_class"
               add_field => { "[@metadata][dns_action]" => "%{[zeek][dns][qclass_name]}" } }
    } else if ([zeek][dns][qtype_name]) {
      mutate { id => "mutate_add_field_metadata_dns_type"
               add_field => { "[@metadata][dns_action]" => "%{[zeek][dns][qtype_name]}" } }
    } else {
      mutate { id => "mutate_add_field_metadata_dns_query"
               add_field => { "[@metadata][dns_action]" => "Query" } }
    }
    mutate { id => "mutate_merge_zeek_dns_action"
             merge => { "[event][action]" => "[@metadata][dns_action]" } }
  }

  # TODO: convert zeek_ecat_foe_info.opcode and zeek_ecat_soe_info.opcode to operations
  # zeek EtherCAT commands/operations
  if ([zeek][ecat_aoe_info][command])            { mutate { id => "mutate_merge_normalize_zeek_ecat_aoe_info_command"
                                                           merge => { "[event][action]" => "[zeek][ecat_aoe_info][command]" } } }
  if ([zeek][ecat_foe_info][opcode])             { mutate { id => "mutate_merge_normalize_zeek_ecat_foe_info_opcode"
                                                           merge => { "[event][action]" => "[zeek][ecat_foe_info][opcode]" } } }
  if ([zeek][ecat_log_address][command])         { mutate { id => "mutate_merge_normalize_zeek_ecat_log_address"
                                                           merge => { "[event][action]" => "[zeek][ecat_log_address][command]" } } }
  if ([zeek][ecat_registers][command])           { mutate { id => "mutate_merge_normalize_zeek_ecat_registers_command"
                                                           merge => { "[event][action]" => "[zeek][ecat_registers][command]" } } }
  if ([zeek][ecat_soe_info][opcode])             { mutate { id => "mutate_merge_normalize_zeek_ecat_soe_info_opcode"
                                                           merge => { "[event][action]" => "[zeek][ecat_soe_info][opcode]" } } }
  if ([zeek][ecat_arp_info][arp_type])           { mutate { id => "mutate_merge_normalize_zeek_ecat_arp_info_arp_type"
                                                           merge => { "[event][action]" => "[zeek][ecat_arp_info][arp_type]" } } }

  if ([zeek][enip][enip_command])                { mutate { id => "mutate_merge_normalize_zeek_enip_enip_command"
                                                           merge => { "[event][action]" => "[zeek][enip][enip_command]" } } }

  if ([zeek][ftp][command])                      { mutate { id => "mutate_merge_normalize_zeek_ftp_command"
                                                           merge => { "[event][action]" => "[zeek][ftp][command]" } } }

  if ([zeek][genisys][direction] == "request") and ([zeek][genisys][header]) {
    mutate { id => "mutate_merge_zeek_genisys_request_header_action"
             merge => { "[event][action]" => "[zeek][genisys][header]" } }
  }

  if ([zeek][ge_srtp]) {
    ruby {
      # action = zeek.ge_srtp.service_request_code:zeek.ge_srtp.message_type
      id => "ruby_zeek_ge_srtp_generate_action"
      code => "
        action = [event.get('[zeek][ge_srtp][service_request_code]'),
                  event.get('[zeek][ge_srtp][message_type]')&.gsub(/\s+\([^\)]*\)\z/, '').to_s].reject{ |e| e.nil? || e.empty? || e == 'Unknown' }.join(':')
        if !action.nil? and (action.length > 0) then
          actions = Array.new unless (actions = event.get('[event][action]'))
          actions.append(action)
          event.set('[event][action]', actions)
        end"
    }
  }

  if ([zeek][hart_ip]) {
    ruby {
      # action = zeek.hart_ip.header_message_type_message_type:zeek.hart_ip.header_message_id
      id => "ruby_zeek_hart_ip_generate_action"
      code => "
        action = [event.get('[zeek][hart_ip][header_message_type_message_type]'),
                  event.get('[zeek][hart_ip][header_message_id]')&.gsub(/\s+\([^\)]*\)\z/, '').to_s].reject{ |e| e.nil? || e.empty? }.join(':')
        if !action.nil? and (action.length > 0) then
          actions = Array.new unless (actions = event.get('[event][action]'))
          actions.append(action)
          event.set('[event][action]', actions)
        end"
    }
  }

  if ([zeek][hart_ip_direct_pdu_command][direct_pdu_command_command_number])  {
    mutate { id => "mutate_merge_normalize_zeek_hart_ip_direct_pdu_command_direct_pdu_command_command_number"
             merge => { "[event][action]" => "[zeek][hart_ip_direct_pdu_command][direct_pdu_command_command_number]" } }
  }

  if ([zeek][http]) {
    if ([zeek][http][method])  {
      mutate { id => "mutate_merge_normalize_zeek_http_method"
               merge => { "[event][action]" => "[zeek][http][method]" } }
    } else {
      mutate { id => "mutate_add_field_zeek_http_request_action"
               add_field => { "[@metadata][http_request_action]" => "Request" } }
      mutate { id => "mutate_merge_field_zeek_http_request_action"
               merge => { "[event][action]" => "[@metadata][http_request_action]" } }
    }
  }

  if ([zeek][irc][command])                      { mutate { id => "mutate_merge_normalize_zeek_irc_command"
                                                           merge => { "[event][action]" => "[zeek][irc][command]" } } }

  if ([zeek][cotp][pdu_name])                    { mutate { id => "mutate_merge_normalize_zeek_cotp_pdu_type"
                                                           merge => { "[event][action]" => "[zeek][cotp][pdu_name]" } } }

  if ([zeek][kerberos][request_type])            { mutate { id => "mutate_merge_normalize_zeek_kerberos_request_type"
                                                           merge => { "[event][action]" => "[zeek][kerberos][request_type]" } } }

  if ([zeek][ldap][operation])                   { mutate { id => "mutate_merge_normalize_zeek_ldap_operation"
                                                           merge => { "[event][action]" => "[zeek][ldap][operation]" } } }

  if ([zeek][ldap_search]) {
    if ([zeek][ldap_search][scope]) {
      mutate { id => "mutate_add_field_zeek_ldap_search_scope_action"
               add_field => { "[@metadata][zeek_ldap_search_action]" => "search %{[zeek][ldap_search][scope]}" } }
    } else {
      mutate { id => "mutate_add_field_zeek_ldap_search_action"
               add_field => { "[@metadata][zeek_ldap_search_action]" => "search" } }
    }
    mutate { id => "mutate_merge_field_zeek_ldap_search_action"
             merge => { "[event][action]" => "[@metadata][zeek_ldap_search_action]" } }
  }

  if ([zeek][modbus][func]) {
    mutate { id => "mutate_gsub_zeek_modbus_master"
             gsub => [ "[zeek][modbus][func]", "MASTER", "CLIENT" ] }
    mutate { id => "mutate_gsub_zeek_modbus_slave"
             gsub => [ "[zeek][modbus][func]", "SLAVE", "SERVER" ] }
    mutate { id => "mutate_merge_normalize_zeek_modbus_func"
             merge => { "[event][action]" => "[zeek][modbus][func]" } }
  }

  if ([zeek][modbus][mei_type]) { mutate { id => "mutate_merge_normalize_zeek_modbus_mei_type"
                                           merge => { "[event][action]" => "[zeek][modbus][mei_type]" } } }

  if ([zeek][mqtt_connect][connect_status]) {
    # this log entry implicitly means "connect"
    mutate { id => "mutate_add_field_zeek_mqtt_connect_action"
             add_field => { "[@metadata][zeek_mqtt_connect_action]" => "Connect" } }
    mutate { id => "mutate_merge_zeek_mqtt_connect_action"
             merge => { "[event][action]" => "[@metadata][zeek_mqtt_connect_action]" } }
  }

  if ([zeek][mqtt_publish]) {
    if ([zeek][mqtt_publish][payload_dict][messageType]) {
      # not sure if this is a standard or just the PCAPs I found :/
      mutate { id => "mutate_merge_normalize_zeek_mqtt_publish_payload_dict_messageType"
      merge => { "[event][action]" => "[zeek][mqtt_publish][payload_dict][messageType]" } }
    } else {
      mutate { id => "mutate_add_field_zeek_mqtt_publish_action"
               add_field => { "[@metadata][zeek_mqtt_publish_action]" => "Publish" } }
      mutate { id => "mutate_merge_zeek_mqtt_publish_action"
               merge => { "[event][action]" => "[@metadata][zeek_mqtt_publish_action]" } }
    }
  }

  if ([zeek][mqtt_subscribe][action])            { mutate { id => "mutate_merge_normalize_zeek_mqtt_subscribe_action"
                                                           merge => { "[event][action]" => "[zeek][mqtt_subscribe][action]" } } }

  if ([zeek][mysql][cmd])                        { mutate { id => "mutate_merge_normalize_zeek_mysql_cmd"
                                                           merge => { "[event][action]" => "[zeek][mysql][cmd]" } } }

  if ([zeek][ntlm][success]) {
    # this log entry implicitly means a login attempt
    mutate { id => "mutate_add_field_zeek_ntlm_action"
             add_field => { "[@metadata][zeek_ntlm_action]" => "Authenticate" } }
    mutate { id => "mutate_merge_zeek_ntlm_action"
             merge => { "[event][action]" => "[@metadata][zeek_ntlm_action]" } }
  }

  if ([zeek][ntp][mode_str])                     { mutate { id => "mutate_merge_normalize_zeek_ntp_mode_str"
                                                           merge => { "[event][action]" => "[zeek][ntp][mode_str]" } } }

  if ([zeek][omron_fins][command_code])          { mutate { id => "mutate_merge_normalize_zeek_omron_fins_command_code"
                                                            merge => { "[event][action]" => "[zeek][omron_fins][command_code]" } } }

  if ([zeek][ospf][ospf_type])                   { mutate { id => "mutate_merge_normalize_zeek_ospf_ospf_type"
                                                            merge => { "[event][action]" => "[zeek][ospf][ospf_type]" } } }

  if ([event][dataset] =~ /^opcua_binary/) {
    if ([zeek][opcua_binary][msg_type] or [zeek][opcua_binary][identifier_str]) {
      ruby {
        # action = msg_type:identifier_str
        id => "ruby_zeek_opcua_binary_generate_action"
        code => "
          actions = Array.new unless (actions = event.get('[event][action]'))
          actions.append([event.get('[zeek][opcua_binary][msg_type]'),
                          event.get('[zeek][opcua_binary][identifier_str]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
          event.set('[event][action]', actions)"
      }
    }

    if ([zeek][opcua_binary_status_code_detail][source_str]) {
                                                     mutate { id => "mutate_merge_normalize_zeek_opcua_binary_status_code_detail_source_str"
                                                              merge => { "[event][action]" => "[zeek][opcua_binary_status_code_detail][source_str]" } } }

    if ([zeek][opcua_binary_browse][browse_service_type]) {
                                                     mutate { id => "mutate_merge_normalize_zeek_opcua_binary_browse_browse_service_type"
                                                              merge => { "[event][action]" => "[zeek][opcua_binary_browse][browse_service_type]" } } }

    if (![event][action]) {
      if ([event][dataset] =~ /^opcua_binary_activate_session/) {
        mutate { id => "mutate_add_field_metadata_opcua_activate_session"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "ActivateSession" } }
      } else if ([event][dataset] =~ /^opcua_binary_browse/) {
        mutate { id => "mutate_add_field_metadata_opcua_browse"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "Browse" } }
      } else if ([event][dataset] == "opcua_binary_close_session") {
        mutate { id => "mutate_add_field_metadata_opcua_close_session"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "CloseSession" } }
      } else if ([event][dataset] == "opcua_binary_create_monitored_items") {
        mutate { id => "mutate_add_field_metadata_opcua_create_monitored_items"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "CreateMonitoredItems" } }
      } else if ([event][dataset] == "opcua_binary_create_session") {
        mutate { id => "mutate_add_field_metadata_opcua_create_session"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "CreateSession" } }
      } else if ([event][dataset] == "opcua_binary_create_subscription") {
        mutate { id => "mutate_add_field_metadata_opcua_create_subscription"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "CreateSubscription" } }
      } else if ([event][dataset] == "opcua_binary_get_endpoints") {
        mutate { id => "mutate_add_field_metadata_opcua_get_endpoints"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "GetEndpoints" } }
      } else if ([event][dataset] =~ /^opcua_binary_read/) {
        mutate { id => "mutate_add_field_metadata_opcua_read"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "Read" } }
      } else if ([event][dataset] =~ /^opcua_binary_write/) {
        mutate { id => "mutate_add_field_metadata_opcua_write"
                 add_field => { "[@metadata][opcua_action_from_dataset]" => "Write" } }
      }
      if ([@metadata][opcua_action_from_dataset]) {
        mutate { id => "mutate_merge_zeek_opcua_action_from_dataset"
                 merge => { "[event][action]" => "[@metadata][opcua_action_from_dataset]" } }
      }
    }
  } # opcua_binary

  if ([zeek][postgresql][frontend])              { mutate { id => "mutate_merge_normalize_zeek_postgresql_frontend_action"
                                                            merge => { "[event][action]" => "[zeek][postgresql][frontend]" } } }

  if ([zeek][profinet][operation_type])          { mutate { id => "mutate_merge_normalize_zeek_profinet_operation_type"
                                                           merge => { "[event][action]" => "[zeek][profinet][operation_type]" } } }

  if ([zeek][profinet_dce_rpc][operation])       { mutate { id => "mutate_merge_normalize_zeek_profinet_dce_rpc_operation"
                                                           merge => { "[event][action]" => "[zeek][profinet_dce_rpc][operation]" } } }

  if ([zeek][profinet_io_cm][packet_type])       { mutate { id => "mutate_merge_normalize_zeek_profinet_io_cm_packet_type"
                                                            merge => { "[event][action]" => "[zeek][profinet_io_cm][packet_type]" } } }

  if ([zeek][profinet_io_cm][operation])         { mutate { id => "mutate_merge_normalize_zeek_profinet_io_cm_operation"
                                                            merge => { "[event][action]" => "[zeek][profinet_io_cm][operation]" } } }

  if ([zeek][rfb][auth]) and ([zeek][rfb][authentication_method]) {
    # if authentication was attempted, assign an "authenticate" action
    mutate { id => "mutate_add_field_zeek_rfb_auth_action"
             add_field => { "[@metadata][zeek_rfb_auth_action]" => "Authenticate" } }
    mutate { id => "mutate_merge_zeek_rfb_auth_action"
             merge => { "[event][action]" => "[@metadata][zeek_rfb_auth_action]" } }
  }

  if ([zeek][s7comm]) {
    ruby {
      # action = rosctr_name:function_name:subfunction_name
      id => "ruby_zeek_s7comm_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        action = [event.get('[zeek][s7comm][rosctr_name]'),
                  event.get('[zeek][s7comm][function_name]'),
                  event.get('[zeek][s7comm][subfunction_name]')].reject{ |e| e.nil? || e&.empty? }.join(':')
        actions.append(action) unless action.nil? || action&.empty?
        event.set('[event][action]', actions)"
    }
  }

  if ([zeek][s7comm_plus]) {
    ruby {
      # action = opcode:function
      id => "ruby_zeek_s7comm_plus_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        if (opcodeName = event.get('[zeek][s7comm_plus][opcode_name]').to_s).start_with?('Unknown') then
          opcodeName = event.get('[zeek][s7comm_plus][opcode]')
        end
        if (functionName = event.get('[zeek][s7comm_plus][function_name]').to_s).start_with?('Unknown') then
          functionName = event.get('[zeek][s7comm_plus][function_code]')
        end
        action = [opcodeName, functionName].reject{ |e| e.nil? || e&.empty? }.join(':')
        actions.append(action) unless action.nil? || action&.empty?
        event.set('[event][action]', actions)"
    }
  }


  if ([zeek][s7comm_read_szl][szl_id_name]) {
    mutate { id => "mutate_add_field_metadata_zeek_s7comm_read_szl_action"
             add_field => { "[@metadata][s7comm_read_szl_action]" => "Read-SZL %{[zeek][s7comm_read_szl][szl_id_name]}" } }
    mutate { id => "mutate_merge_zeek_s7comm_read_szl_action"
             merge => { "[event][action]" => "[@metadata][s7comm_read_szl_action]" } }
  }

  if ([zeek][s7comm_upload_download]) {
    ruby {
      # action = rosctr_name:function_name
      id => "ruby_zeek_s7comm_upload_download_generate_action"
      code => "
        actions = Array.new unless (actions = event.get('[event][action]'))
        action = [event.get('[zeek][s7comm_upload_download][rosctr_name]'),
                  event.get('[zeek][s7comm_upload_download][function_name]')].reject{ |e| e.nil? || e&.empty? }.join(':')
        actions.append(action) unless action.nil? || action&.empty?
        event.set('[event][action]', actions)"
    }
  }

  if ([zeek][sip][method]) { mutate { id => "mutate_merge_normalize_zeek_sip_method"
                                     merge => { "[event][action]" => "[zeek][sip][method]" } } }

  if ([zeek][smtp]) {
    # action depends on varios smtp headers' presence
    if ([zeek][smtp][last_reply]) {
      if ([zeek][smtp][msg_id]) {
        mutate { id => "mutate_add_field_zeek_smtp_action_deliver"
                 add_field => { "[@metadata][zeek_smtp_action]" => "Deliver message" } }
      } else if ([zeek][smtp][mailfrom]) {
        mutate { id => "mutate_add_field_zeek_smtp_action_queue"
                 add_field => { "[@metadata][zeek_smtp_action]" => "Queue message" } }
      } else {
        mutate { id => "mutate_add_field_zeek_smtp_action_connect_reply"
                 add_field => { "[@metadata][zeek_smtp_action]" => "Connect" } }
      }
    } else {
      mutate { id => "mutate_add_field_zeek_smtp_action_connect_no_reply"
               add_field => { "[@metadata][zeek_smtp_action]" => "Connect" } }
    }
    if ([@metadata][zeek_smtp_action]) {
      mutate { id => "mutate_merge_zeek_smtp_action"
               merge => { "[event][action]" => "[@metadata][zeek_smtp_action]" } }
    }
  }

  if ([zeek][socks]) {
    # socks action is "Authenticate" or "Connect" based on user/password or not
    if ([zeek][socks][user]) or ([zeek][socks][password]) {
      mutate { id => "mutate_add_field_zeek_socks_action_authenticate"
               add_field => { "[@metadata][zeek_socks_action]" => "Authenticate" } }
    } else {
      mutate { id => "mutate_add_field_zeek_socks_action_connect"
               add_field => { "[@metadata][zeek_socks_action]" => "Connect" } }
    }
    if ([@metadata][zeek_socks_action]) {
      mutate { id => "mutate_merge_zeek_socks_action"
               merge => { "[event][action]" => "[@metadata][zeek_socks_action]" } }
    }
  }

  if ([zeek][smb_cmd]) {
    ruby {
      # action = command:sub_command
      id => "ruby_zeek_smb_cmd_generate_action"
      code => "
        cmd = event.get('[zeek][smb_cmd][command]')
        subCmd = event.get('[zeek][smb_cmd][sub_command]')
        actions = Array.new unless (actions = event.get('[event][action]'))
        actions.append((cmd =~ /^\s*transaction\d*\s*$/i) ? subCmd : [cmd, subCmd].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][action]', actions)"
    }
  }

  if ([zeek][smb_files][action])   { mutate { id => "mutate_merge_normalize_zeek_smb_files_action"
                                             merge => { "[event][action]" => "[zeek][smb_files][action]" } } }

  if ([zeek][snmp]) {
    # action based on > 0 values for variou get/set PDUs
    if ([zeek][snmp][get_bulk_requests]) and ([zeek][snmp][get_bulk_requests] != "0") {
      mutate { id => "mutate_add_field_zeek_snmp_get_bulk_requests_action"
               add_field => { "[@metadata][snmp_get_bulk_requests_action]" => "get_bulk_request" } }
      mutate { id => "mutate_merge_zeek_snmp_action_get_bulk_requests"
               merge => { "[event][action]" => "[@metadata][snmp_get_bulk_requests_action]" } }
    }
    if ([zeek][snmp][get_requests]) and ([zeek][snmp][get_requests] != "0") {
      mutate { id => "mutate_add_field_zeek_snmp_get_requests_action"
               add_field => { "[@metadata][snmp_get_requests_action]" => "get_request" } }
      mutate { id => "mutate_merge_zeek_snmp_action_get_requests"
               merge => { "[event][action]" => "[@metadata][snmp_get_requests_action]" } }
    }
    if ([zeek][snmp][get_responses]) and ([zeek][snmp][get_responses] != "0") {
      mutate { id => "mutate_add_field_zeek_snmp_get_responses_action"
               add_field => { "[@metadata][snmp_get_responses_action]" => "get_response" } }
      mutate { id => "mutate_merge_zeek_snmp_action_get_responses"
               merge => { "[event][action]" => "[@metadata][snmp_get_responses_action]" } }
    }
    if ([zeek][snmp][set_requests]) and ([zeek][snmp][set_requests] != "0") {
      mutate { id => "mutate_add_field_zeek_snmp_set_requests_action"
               add_field => { "[@metadata][snmp_set_requests_action]" => "set_request" } }
      mutate { id => "mutate_merge_zeek_snmp_action_set_requests"
               merge => { "[event][action]" => "[@metadata][snmp_set_requests_action]" } }
    }
  }

  if ([zeek][ssh]) {
    # ssh action is "Authenticate" or "Connect" based on auth_attempts
    if ([zeek][ssh][auth_attempts]) {
      mutate { id => "mutate_add_field_zeek_ssh_action_authenticate"
               add_field => { "[@metadata][zeek_ssh_action]" => "Authenticate" } }
    } else {
      mutate { id => "mutate_add_field_zeek_ssh_action_connect"
               add_field => { "[@metadata][zeek_ssh_action]" => "Connect" } }
    }
    if ([@metadata][zeek_ssh_action]) {
      mutate { id => "mutate_merge_zeek_ssh_action"
               merge => { "[event][action]" => "[@metadata][zeek_ssh_action]" } }
    }
  }

  if ([zeek][ssl]) {
    # SSL action will be either "connect", "validate", "resume"
    if ([zeek][ssl][resumed] == "T") {
      mutate { id => "mutate_add_field_zeek_ssl_resume"
               add_field => { "[@metadata][zeek_ssl_action]" => "Resume" } }
    } else if ([zeek][ssl][established] != "T") and ([zeek][ssl][validation_status]) and ([zeek][ssl][validation_status] != "ok") {
      mutate { id => "mutate_add_field_zeek_ssl_validate"
               add_field => { "[@metadata][zeek_ssl_action]" => "Validate Certificate" } }
    } else {
      mutate { id => "mutate_add_field_zeek_ssl_connect"
               add_field => { "[@metadata][zeek_ssl_action]" => "Connect" } }
    }
    mutate { id => "mutate_merge_zeek_ssl_action"
             merge => { "[event][action]" => "[@metadata][zeek_ssl_action]" } }
  }

  if ([zeek][stun][method]) { mutate { id => "mutate_merge_normalize_zeek_stun_method"
                                      merge => { "[event][action]" => "[zeek][stun][method]" } } }

  if ([zeek][synchrophasor_cmd][command]) { mutate { id => "mutate_merge_normalize_zeek_synchrophasor_cmd_command"
                                                     merge => { "[event][action]" => "[zeek][synchrophasor_cmd][command]" } } }

  if ([zeek][tds][command]) { mutate { id => "mutate_merge_normalize_zeek_tds_command"
                             merge => { "[event][action]" => "[zeek][tds][command]" } } }

  if ([zeek][tds_rpc][procedure_name]) {
    mutate { id => "mutate_add_field_zeek_tds_rpc_procedure_name_tmp"
             add_field => { "[@metadata][zeek_tds_rpc_procedure_name_tmp]" => "%{[zeek][tds_rpc][procedure_name]}" } }

    # remove everything after the first $
    mutate { id => "mutate_gsub_field_zeek_tds_rpc_procedure_name_tmp"
             gsub => [ "[@metadata][zeek_tds_rpc_procedure_name_tmp]", "\$.*", "" ] }

    mutate { id => "mutate_merge_normalize_zeek_tds_rpc_procedure_name"
             merge => { "[event][action]" => "[@metadata][zeek_tds_rpc_procedure_name_tmp]" } }
  }

  if ([zeek][tftp][wrq]) {
    if ([zeek][tftp][wrq] == "T") {
      mutate { id => "mutate_add_field_zeek_tftp_wrq"
               add_field => { "[@metadata][zeek_tftp_action]" => "Write" } }
    } else {
      mutate { id => "mutate_add_field_zeek_tftp_connect"
               add_field => { "[@metadata][zeek_tftp_action]" => "Read" } }
    }
    mutate { id => "mutate_merge_zeek_tftp_action"
             merge => { "[event][action]" => "[@metadata][zeek_tftp_action]" } }
  }

  if ([zeek][tunnel][action])  { mutate { id => "mutate_merge_normalize_zeek_tunnel_action"
                                         merge => { "[event][action]" => "[zeek][tunnel][action]" } } }

  # Result ############################################################################################################
  # collect all result/status/response/errors under the parent [event][result] array

  if ([zeek][bacnet][result_code]) {
    mutate { id => "mutate_merge_normalize_zeek_bacnet_result_code"
             merge => { "[event][result]" => "[zeek][bacnet][result_code]" } }
  } else if ([zeek][bacnet_device_control][result]) or ([zeek][bacnet_device_control][result_code]) {
    if ([zeek][bacnet_device_control][result]) {
      mutate { id => "mutate_lowercase_zeek_bacnet_device_control_result"
               capitalize => [ "[zeek][bacnet_device_control][result]" ] }
      mutate { id => "mutate_merge_zeek_bacnet_device_control_result"
               merge => { "[event][result]" => "[zeek][bacnet_device_control][result]" } }
    }
    if ([zeek][bacnet_device_control][result_code]) {
      mutate { id => "mutate_merge_zeek_bacnet_device_control_result_code"
               merge => { "[event][result]" => "[zeek][bacnet_device_control][result_code]" } }
    }
  } else if ([zeek][bacnet][pdu_service]) {
    mutate { id => "mutate_add_field_zeek_bacnet_success"
             add_field => { "[@metadata][zeek_bacnet_result]" => "Success" } }
    mutate { id => "mutate_merge_field_zeek_bacnet_success"
             merge => { "[event][result]" => "[@metadata][zeek_bacnet_result]" } }
  }

  if ([zeek][cip][cip_status] or [zeek][cip][cip_extended_status]) {
    ruby {
      # result = cip_status:cip_extended_status
      id => "ruby_zeek_cip_generate_result"
      code => "
        results = Array.new unless (results = event.get('[event][result]'))
        results.append([event.get('[zeek][cip][cip_status]'),
                        event.get('[zeek][cip][cip_extended_status]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][result]', results)"
    }
  }

  if ([zeek][cip][cip_status]) { mutate { id => "mutate_merge_normalize_zeek_cip_status_result"
                                         merge => { "[event][result]" => "[zeek][cip][cip_status]" } } }

  if ([zeek][dhcp]) {
    # dhcp server_message and client_message populate result, as do ACK and NAK message types
    if ([zeek][dhcp][server_message])  { mutate { id => "mutate_merge_normalize_zeek_dhcp_server_message"
                                                 merge => { "[event][result]" => "[zeek][dhcp][server_message]" } } }
    if ([zeek][dhcp][client_message])  { mutate { id => "mutate_merge_normalize_zeek_dhcp_client_message"
                                                 merge => { "[event][result]" => "[zeek][dhcp][client_message]" } } }
    if ("ACK" in [zeek][dhcp][msg_types]) {
      mutate { id => "mutate_add_field_zeek_dhcp_ack_result"
               add_field => { "[@metadata][zeek_dhcp_result]" => "Success" } }
    } else if ("NAK" in [zeek][dhcp][msg_types]) {
      mutate { id => "mutate_add_field_zeek_dhcp_nak_result"
               add_field => { "[@metadata][zeek_dhcp_result]" => "Failure" } }
    }
    if ([@metadata][zeek_dhcp_result]) {
      mutate { id => "mutate_merge_zeek_dhcp_result"
               merge => { "[event][result]" => "[@metadata][zeek_dhcp_result]" } }
    }
  }

  # dnp3: fc_reply and iin_flags
  if ([zeek][dnp3][fc_reply])  { mutate { id => "mutate_merge_zeek_dnp3_fc_reply"
                                         merge => { "[event][result]" => "[zeek][dnp3][fc_reply]" } } }
  if ([zeek][dnp3][iin_flags]) { mutate { id => "mutate_merge_zeek_dnp3_iin_flags"
                                         merge => { "[event][result]" => "[zeek][dnp3][iin_flags]" } } }

  # dnp3_control.status_code
  if ([zeek][dnp3_control][status_code]) { mutate { id => "mutate_merge_zeek_dnp3_control_status_code"
                                                   merge => { "[event][result]" => "[zeek][dnp3_control][status_code]" } } }

  if ([zeek][dns]) {
    # DNS result is populated by rcode_name (with NOERROR being translated to Success), and rejected
    if ([zeek][dns][rcode_name]) {
      if ([zeek][dns][rcode_name] == 'NOERROR') {
        mutate { id => "mutate_add_field_zeek_dns_noerror"
                 add_field => { "[@metadata][zeek_dns_result]" => "Success" } }
        mutate { id => "mutate_merge_field_zeek_dns_noerror"
                 merge => { "[event][result]" => "[@metadata][zeek_dns_result]" } }
      } else {
        mutate { id => "mutate_merge_normalize_zeek_dns_rcode_name"
                 merge => { "[event][result]" => "[zeek][dns][rcode_name]" } }
      }
    }
    if ([zeek][dns][rejected] == 'T') {
      mutate { id => "mutate_add_field_zeek_dns_rejected"
               add_field => { "[@metadata][zeek_dns_rejected_result]" => "Rejected" } }
      mutate { id => "mutate_merge_field_zeek_dns_rejected"
               merge => { "[event][result]" => "[@metadata][zeek_dns_rejected_result]" } }
    }
  }

  # TODO: convert zeek_ecat_foe_info.error_code and zeek_ecat_soe_info.error to strings?
  # zeek_ecat_foe_info.error_code and zeek_ecat_soe_info.error
  if ([zeek][ecat_foe_info][error_code])        { mutate { id => "mutate_merge_normalize_zeek_ecat_foe_info_error_code"
                                                          merge => { "[event][result]" => "[zeek][ecat_foe_info][error_code]" } } }
  if ([zeek][ecat_soe_info][error])             { mutate { id => "mutate_merge_normalize_zeek_ecat_soe_info_error"
                                                          merge => { "[event][result]" => "[zeek][ecat_soe_info][error]" } } }

  # zeek_enip.enip_status
  if ([zeek][enip][enip_status])         { mutate { id => "mutate_merge_normalize_zeek_enip_enip_status"
                                                   merge => { "[event][result]" => "[zeek][enip][enip_status]" } } }

  if ([zeek][ftp][reply_code]) {
    # normalized version of reply code (reply_msg is too unpredictable)
    translate {
      id => "translate_zeek_ftp_reply_code"
      source => "[zeek][ftp][reply_code]"
      target => "[@metadata][zeek_ftp_mapped_result]"
      dictionary_path => "/etc/ftp_result_codes.yaml"
    }
    if ([@metadata][zeek_ftp_mapped_result]) {
      mutate { id => "mutate_merge_zeek_ftp_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_ftp_mapped_result]" } }
    } else if ([zeek][ftp][reply_msg]) {
      mutate { id => "mutate_merge_zeek_ftp_reply_msg_result"
               merge => { "[event][result]" => "[zeek][ftp][reply_msg]" } }
    } else {
      mutate { id => "mutate_merge_zeek_ftp_reply_code_result"
               merge => { "[event][result]" => "[zeek][ftp][reply_code]" } }
    }
  }

  if ([zeek][genisys][direction] == "response") and ([zeek][genisys][header]) {
    mutate { id => "mutate_merge_zeek_genisys_response_header_result"
             merge => { "[event][result]" => "[zeek][genisys][header]" } }
  }

  if ([zeek][ge_srtp]) {
    ruby {
      # action = zeek.ge_srtp.status_code,zeek.ge_srtp.minor_status_code
      id => "ruby_zeek_ge_srtp_generate_result"
      code => "
        result = [event.get('[zeek][ge_srtp][status_code]').to_s.gsub(/No Error Occurred/, 'Success'),
                  event.get('[zeek][ge_srtp][minor_status_code]').to_s.gsub(/No Minor Error Occurred/, 'Success')].reject{ |e| e.nil? || e.empty? || e == 'Unknown' }.uniq.join(':')
        if !result.nil? and (result.length > 0) then
          results = Array.new unless (results = event.get('[event][result]'))
          results.append(result)
          event.set('[event][result]', results)
        end"
    }
  }

  if ([zeek][hart_ip][header_status_code]) { mutate { id => "mutate_merge_normalize_zeek_hart_ip_header_status_code_result"
                                                      merge => { "[event][result]" => "[zeek][hart_ip][header_status_code]" } } }
  if ([zeek][hart_ip_direct_pdu_command][direct_pdu_contents_response_response_code]) {
    mutate { id => "mutate_merge_normalize_zeek_hart_ip_direct_pdu_command_direct_pdu_contents_response_response_code"
             merge => { "[event][result]" => "[zeek][hart_ip_direct_pdu_command][direct_pdu_contents_response_response_code]" } }
  }

  if ([zeek][http][status_code]) {
    # normalized version of http reply code (status_msg is too unpredictable)
    translate {
      id => "translate_zeek_http_reply_code"
      source => "[zeek][http][status_code]"
      target => "[@metadata][zeek_http_mapped_result]"
      dictionary_path => "/etc/http_result_codes.yaml"
    }
    if ([@metadata][zeek_http_mapped_result]) {
      mutate { id => "mutate_merge_zeek_http_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_http_mapped_result]" } }
    } else if ([zeek][http][status_msg]) {
      mutate { id => "mutate_merge_zeek_http_status_msg_result"
               merge => { "[event][result]" => "[zeek][http][status_msg]" } }
    } else {
      mutate { id => "mutate_merge_zeek_http_status_code_result"
               merge => { "[event][result]" => "[zeek][http][status_code]" } }
    }
  }

  if ([zeek][kerberos]) {
    # result populated from success and error_msg
    if ([zeek][kerberos][success] == 'T') {
      mutate { id => "mutate_add_field_zeek_zeek_kerberos_success"
               add_field => { "[@metadata][zeek_kerberos_result]" => "Success" } }
    } else if ([zeek][kerberos][error_msg]) {
      mutate { id => "mutate_add_field_zeek_zeek_kerberos_error_msg"
               add_field => { "[@metadata][zeek_kerberos_result]" => "%{[zeek][kerberos][error_msg]}" } }
    } else {
      mutate { id => "mutate_add_field_zeek_zeek_kerberos_failure"
               add_field => { "[@metadata][zeek_kerberos_result]" => "Failure" } }
    }
    mutate { id => "mutate_merge_zeek_kerberos_result"
             merge => { "[event][result]" => "[@metadata][zeek_kerberos_result]" } }
  }

  # (zeek_ldap|zeek_ldap_search).(result_code)
  if ([zeek][ldap][result_code])            { mutate { id => "mutate_merge_normalize_zeek_ldap_result_code"
                                                      merge => { "[event][result]" => "[zeek][ldap][result_code]" } } }
  if ([zeek][ldap_search][result_code])     { mutate { id => "mutate_merge_normalize_zeek_ldap_search_result_code"
                                                      merge => { "[event][result]" => "[zeek][ldap_search][result_code]" } } }

  if ([zeek][modbus]) {
    mutate { id => "mutate_lowercase_field_modbus_network_direction"
             lowercase => [ "[zeek][modbus][network_direction]" ] }
    if ([zeek][modbus][exception]) {
      # we have an exception, so set that as result
      mutate { id => "mutate_merge_normalize_zeek_modbus_exception"
               merge => { "[event][result]" => "[zeek][modbus][exception]" } }
    } else if ([zeek][modbus][func]) and
              (([zeek][modbus][network_direction] != "response") or (!([zeek][modbus][func] =~ /EXCEPTION$/))) {
      # no exception, but... we have a func, so just assume "Success"
      mutate { id => "mutate_add_field_zeek_modbus_success"
               add_field => { "[@metadata][zeek_modbus_result]" => "Success" } }
      mutate { id => "mutate_merge_field_zeek_modbus_success"
               merge => { "[event][result]" => "[@metadata][zeek_modbus_result]" } }
    }
    if ([zeek][modbus][network_direction] == "response") and ([zeek][modbus][func] =~ /EXCEPTION$/) {
      # direction is "response" and func ends in EXCEPTION, so also set that as result
      mutate { id => "mutate_merge_normalize_zeek_modbus_exception_func_response"
               merge => { "[event][result]" => "[zeek][modbus][func]" } }
      # and, for cross-referencing purposes, store the part before _EXCEPTION in action as well
      mutate { id => "mutate_merge_normalize_modbus_func_exception_meta"
               merge => { "[@metadata][modbus_func_exception]" => "[zeek][modbus][func]" } }
      mutate { id => "mutate_gsub_normalize_zeek_modbus_exception_as_action"
               gsub => [ "[@metadata][modbus_func_exception]", "_?EXCEPTION", "" ] }
      mutate { id => "mutate_merge_normalize_zeek_modbus_exception_as_action"
               merge => { "[event][action]" => "[@metadata][modbus_func_exception]" } }
    }
  }

  # result for zeek_mqtt_connect: connect_status.'Connection Accepted' -> 'Success', else connect_status
  if ([zeek][mqtt_connect][connect_status] == 'Connection Accepted') {
    mutate { id => "mutate_add_field_zeek_mqtt_connect_success"
             add_field => { "[@metadata][zeek_mqtt_connect_success]" => "Success" } }
    mutate { id => "mutate_merge_field_zeek_mqtt_connect_success"
             merge => { "[event][result]" => "[@metadata][zeek_mqtt_connect_success]" } }
  } else if ([zeek][mqtt_connect][connect_status]) {
    mutate { id => "mutate_merge_zeek_mqtt_connect_connect_status"
             merge => { "[event][result]" => "[zeek][mqtt_connect][connect_status]" } }
  }

  # result for zeek_mqtt_publish: status.'ok' -> 'Success', else status
  if ([zeek][mqtt_publish][status] == 'ok') {
    mutate { id => "mutate_add_field_zeek_mqtt_publish_success"
             add_field => { "[@metadata][zeek_mqtt_publish_success]" => "Success" } }
    mutate { id => "mutate_merge_field_zeek_mqtt_publish_success"
             merge => { "[event][result]" => "[@metadata][zeek_mqtt_publish_success]" } }
  } else if ([zeek][mqtt_publish][status]) {
    mutate { id => "mutate_merge_zeek_mqtt_publish_publish_status"
             merge => { "[event][result]" => "[zeek][mqtt_publish][status]" } }
  }

  # zeek_mqtt_subscribe.ack.'T' -> 'Acknowledged'
  if ([zeek][mqtt_subscribe][ack] == 'T') {
    mutate { id => "mutate_add_field_zeek_mqtt_subscribe_ack"
             add_field => { "[@metadata][zeek_mqtt_subscribe_acknowledged]" => "Acknowledged" } }
    mutate { id => "mutate_merge_field_zeek_mqtt_subscribe_ack"
             merge => { "[event][result]" => "[@metadata][zeek_mqtt_subscribe_acknowledged]" } }
  }

  if ([zeek][mysql]) {
    # mysql result comes from success and response
    if ([zeek][mysql][success] == "T") {
      mutate { id => "mutate_add_field_zeek_mysql_success"
               add_field => { "[@metadata][zeek_mysql_result]" => "Success" } }
    } else if ([zeek][mysql][response] =~ /^Access denied/) {
      mutate { id => "mutate_add_field_zeek_mysql_access"
               add_field => { "[@metadata][zeek_mysql_result]" => "Access denied" } }
    } else {
      mutate { id => "mutate_add_field_zeek_mysql_failure"
               add_field => { "[@metadata][zeek_mysql_result]" => "Failure" } }
    }
    mutate { id => "mutate_merge_zeek_mysql_result"
             merge => { "[event][result]" => "[@metadata][zeek_mysql_result]" } }
  }

  if ([zeek][ntlm]) {
    # ntlm result comes from .success
    if ([zeek][ntlm][success] == "T") {
      mutate { id => "mutate_add_field_zeek_ntlm_success"
               add_field => { "[@metadata][zeek_ntlm_result]" => "Success" } }
    } else {
      mutate { id => "mutate_add_field_zeek_ntlm_failure"
               add_field => { "[@metadata][zeek_ntlm_result]" => "Failure" } }
    }
    mutate { id => "mutate_merge_zeek_ntlm_result"
             merge => { "[event][result]" => "[@metadata][zeek_ntlm_result]" } }
  }

  if ([zeek][omron_fins][response_code]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_response_code"
                                                    merge => { "[event][result]" => "[zeek][omron_fins][response_code]" } } }
  if ([zeek][omron_fins_data_link_status_read][error_status]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_data_link_status_read_error_status"
                                                                         merge => { "[event][result]" => "[zeek][omron_fins_data_link_status_read][error_status]" } } }
  if ([zeek][omron_fins_data_link_status_read][warning_status]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_data_link_status_read_warning_status"
                                                                         merge => { "[event][result]" => "[zeek][omron_fins_data_link_status_read][warning_status]" } } }
  if ([zeek][omron_fins_error][error_code_1]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_error_error_code_1"
                                                         merge => { "[event][result]" => "[zeek][omron_fins_error][error_code_1]" } } }
  if ([zeek][omron_fins_error][error_code_2]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_error_error_code_2"
                                                         merge => { "[event][result]" => "[zeek][omron_fins_error][error_code_2]" } } }
  if ([zeek][omron_fins_error][error_reset_fal_no]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_error_error_reset_fal_no"
                                                               merge => { "[event][result]" => "[zeek][omron_fins_error][error_reset_fal_no]" } } }
  if ([zeek][omron_fins_error][response_code]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_error_response_code"
                                                          merge => { "[event][result]" => "[zeek][omron_fins_error][response_code]" } } }
  if ([zeek][omron_fins_network_status_read][exit_status]) { mutate { id => "mutate_merge_normalize_zeek_omron_fins_network_status_read_exit_status"
                                                                      merge => { "[event][result]" => "[zeek][omron_fins_network_status_read][exit_status]" } } }

  if ([zeek][opcua_binary][error] or [zeek][opcua_binary][reason]) {
    ruby {
      # result = error:reason
      id => "ruby_zeek_opcua_binary_generate_result"
      code => "
        results = Array.new unless (results = event.get('[event][result]'))
        results.append([event.get('[zeek][opcua_binary][error]'),
                        event.get('[zeek][opcua_binary][reason]')].reject{ |e| e.nil? || e&.empty? }.join(':'))
        event.set('[event][result]', results)"
    }
  }

  if ([zeek][opcua_binary_status_code_detail][severity_str] or [zeek][opcua_binary_status_code_detail][sub_code_str]) {
    ruby {
      # result = severity_str:sub_code_str
      id => "ruby_zeek_opcua_binary_status_code_detail_generate_result"
      code => "
        results = Array.new unless (results = event.get('[event][result]'))
        errClass = event.get('[zeek][opcua_binary_status_code_detail][severity_str]').to_s.delete_prefix('Severity_')
        errMsg = event.get('[zeek][opcua_binary_status_code_detail][sub_code_str]')
        errClass = if (errClass == 'Good')
                     'Success'
                   elsif (errClass == 'Bad')
                     'Failure'
                   else
                     errClass
                   end
        errMsg = if (errMsg == 'Good')
                   'Success'
                 elsif (errMsg == 'Bad')
                   'Failure'
                 else
                   errMsg
                 end
        errFinal = [errClass, errMsg].reject{ |e| e.nil? || e&.empty? }.uniq.join(':')
        results.append(errFinal) unless errFinal&.empty?
        event.set('[event][result]', results) unless (results.length == 0)"
    }
  }

  if ([zeek][postgresql]) {
    # postgresql result comes from success and backend
    if ([zeek][postgresql][backend]) {
      mutate { id => "mutate_add_field_zeek_postgresql_result_backend"
               add_field => { "[@metadata][zeek_postgresql_result]" => "%{[zeek][postgresql][backend]}" } }
    } else if ([zeek][postgresql][success] == "T") {
      mutate { id => "mutate_add_field_zeek_postgresql_result_success"
               add_field => { "[@metadata][zeek_postgresql_result]" => "Success" } }
    } else if ([zeek][postgresql][success] == "F") {
      mutate { id => "mutate_add_field_zeek_postgresql_result_failure"
               add_field => { "[@metadata][zeek_postgresql_result]" => "Failure" } }
    }
    if ([@metadata][zeek_postgresql_result]) {
      mutate { id => "mutate_merge_zeek_postgresql_result"
               merge => { "[event][result]" => "[@metadata][zeek_postgresql_result]" }
               remove_field => [ "[zeek][postgresql][success]" ] }
    }
  }

  if ([zeek][radius][result]) {
    if ([zeek][radius][result] =~ /^(?i)succ/) {
      mutate { id => "mutate_add_field_zeek_radius_success"
               add_field => { "[@metadata][zeek_radius_result]" => "Success" } }
    } else if ([zeek][radius][result] =~ /^(?i)fail/) {
      mutate { id => "mutate_add_field_zeek_radius_failure"
               add_field => { "[@metadata][zeek_radius_result]" => "Failure" } }
    } else {
      mutate { id => "mutate_add_field_zeek_radius_result_fallback"
               add_field => { "[@metadata][zeek_radius_result]" => "%{[zeek][radius][result]}" } }
    }
    mutate { id => "mutate_merge_zeek_radius_result"
             merge => { "[event][result]" => "[@metadata][zeek_radius_result]" } }
    # if authentication was attempted, also assign an "authenticate" action
    mutate { id => "mutate_add_field_zeek_radius_auth_action"
             add_field => { "[@metadata][zeek_radius_auth_action]" => "Authenticate" } }
    mutate { id => "mutate_merge_zeek_radius_auth_action"
             merge => { "[event][action]" => "[@metadata][zeek_radius_auth_action]" } }
  }

  if ([zeek][rdp][result]) { mutate { id => "mutate_merge_normalize_zeek_rdp_result"
                                            merge => { "[event][result]" => "[zeek][rdp][result]" } } }

  if ([zeek][s7comm]) {
    if ([zeek][s7comm][error_class] == 'No error') {
      mutate { id => "mutate_add_field_zeek_s7comm_success"
               add_field => { "[@metadata][zeek_s7comm_success]" => "Success" } }
      mutate { id => "mutate_merge_field_zeek_s7comm_success"
               merge => { "[event][result]" => "[@metadata][zeek_s7comm_success]" } }
    } else if ([zeek][s7comm][error_class]) {
      mutate { id => "mutate_merge_zeek_s7comm_non_status"
               merge => { "[event][result]" => "[zeek][s7comm][error_class]" } }
    }
  }

  if ([zeek][s7comm_read_szl]) {
    if ([zeek][s7comm_read_szl][return_code_name]) {
      mutate { id => "mutate_merge_zeek_s7comm_read_szl_return_code_name_result"
               merge => { "[event][result]" => "[zeek][s7comm_read_szl][return_code_name]" } }
    } else if ([zeek][s7comm_read_szl][return_code]) {
      mutate { id => "mutate_merge_zeek_s7comm_read_szl_return_code_result"
               merge => { "[event][result]" => "[zeek][s7comm_read_szl][return_code]" } }
    }
  }

  if ([zeek][s7comm_upload_download][function_status]) { mutate { id => "mutate_merge_normalize_zeek_s7comm_upload_download_function_status"
                                                                  merge => { "[event][result]" => "[zeek][s7comm_upload_download][function_status]" } } }

  if ([zeek][sip][status_code]) {
    # normalized version of sip reply code (status_msg may be unpredictable)
    translate {
      id => "translate_zeek_sip_reply_code"
      source => "[zeek][sip][status_code]"
      target => "[@metadata][zeek_sip_mapped_result]"
      dictionary_path => "/etc/sip_result_codes.yaml"
    }
    if ([@metadata][zeek_sip_mapped_result]) {
      mutate { id => "mutate_merge_zeek_sip_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_sip_mapped_result]" } }
    } else if ([zeek][sip][status_msg]) {
      mutate { id => "mutate_merge_zeek_sip_status_msg_result"
               merge => { "[event][result]" => "[zeek][sip][status_msg]" } }
    } else {
      mutate { id => "mutate_merge_zeek_sip_status_code_result"
               merge => { "[event][result]" => "[zeek][sip][status_code]" } }
    }
  }

  if ([zeek][smb_cmd][status]) {
    # zeek_smb_cmd.status (SUCCESS, NO_SUCH_FILE, ACCESS_DENIED, OBJECT_NAME_COLLISION, etc.)
    translate {
      id => "translate_zeek_smb_cmd_status"
      source => "[zeek][smb_cmd][status]"
      target => "[@metadata][zeek_smb_cmd_mapped_result]"
      dictionary => {
        "SUCCESS" => "Success"
        # TODO... normalize other codes? or maybe just case-normalize and remove underscores/dashes?
        # e.g., "ACCESS_DENIED".split(/[_-]/).collect(&:capitalize).join(' ')
      }
      fallback => "%{[zeek][smb_cmd][status]}"
    }
    if ([@metadata][zeek_smb_cmd_mapped_result]) {
      mutate { id => "mutate_merge_zeek_smb_cmd_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_smb_cmd_mapped_result]" } }
    }
  }

  if ([zeek][smtp]) {
    if ([zeek][smtp][last_reply_code]) {
      # normalized version of smtp reply code (last_reply may be unpredictable)
      translate {
        id => "translate_zeek_smtp_last_reply_code"
        source => "[zeek][smtp][last_reply_code]"
        target => "[@metadata][zeek_smtp_mapped_result]"
        dictionary_path => "/etc/smtp_result_codes.yaml"
      }
    }
    if ([@metadata][zeek_smtp_mapped_result]) {
      mutate { id => "mutate_merge_zeek_smtp_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_smtp_mapped_result]" } }
    } else if ([zeek][smtp][last_reply]) {
      mutate { id => "mutate_merge_zeek_smtp_last_reply_result"
               merge => { "[event][result]" => "[zeek][smtp][last_reply]" } }
    }
  }

  if ([zeek][socks][server_status]) {
    translate {
      id => "translate_zeek_socks_server_status"
      source => "[zeek][socks][server_status]"
      target => "[@metadata][zeek_socks_mapped_result]"
      dictionary => {
        "succeeded" => "Success"
        # TODO... normalize other codes (figure out what they are)
      }
    }
    if ([@metadata][zeek_socks_mapped_result]) {
      mutate { id => "mutate_merge_zeek_socks_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_socks_mapped_result]" } }
    } else if ([zeek][socks][server_status]) {
      mutate { id => "mutate_merge_zeek_socks_server_status_result"
               merge => { "[event][result]" => "[zeek][socks][server_status]" } }
    }
  }

  if ([zeek][ssh][auth_success]) {
    translate {
      id => "translate_zeek_ssh_auth_success"
      source => "[zeek][ssh][auth_success]"
      target => "[@metadata][zeek_ssh_mapped_result]"
      dictionary => {
        "T" => "Success"
        "F" => "Failure"
      }
    }
    if ([@metadata][zeek_ssh_mapped_result]) {
      mutate { id => "mutate_merge_zeek_ssh_mapped_result"
               merge => { "[event][result]" => "[@metadata][zeek_ssh_mapped_result]" } }
    }
  }

  if ([zeek][ssl]) {
    if ([zeek][ssl][established] == "T") {
      mutate { id => "mutate_add_field_zeek_ssl_result_success"
               add_field => { "[@metadata][zeek_ssl_mapped_success_result]" => "Success" } }
    } else if (![zeek][ssl][last_alert]) {
      mutate { id => "mutate_add_field_zeek_ssl_result_failure"
               add_field => { "[@metadata][zeek_ssl_mapped_success_result]" => "Failure" } }
    }
    if ([@metadata][zeek_ssl_mapped_success_result]) {
      mutate { id => "mutate_merge_zeek_ssl_mapped_success_result"
               merge => { "[event][result]" => "[@metadata][zeek_ssl_mapped_success_result]" } }
    }
    if ([zeek][ssl][last_alert]) {
      mutate { id => "mutate_merge_field_zeek_ssl_result_last_alert"
               merge => { "[event][result]" => "[zeek][ssl][last_alert]" } }
    }
    if ([zeek][ssl][validation_status]) and ([zeek][ssl][validation_status] != 'ok') {
      mutate { id => "mutate_merge_field_zeek_ssl_result_validation_status"
               merge => { "[event][result]" => "[zeek][ssl][validation_status]" } }
    }
  }

  if ([zeek][stun][class]) {
    if ([zeek][stun][class] == "RESPONSE_SUCCESS") {
      mutate { id => "mutate_add_field_zeek_stun_success"
               add_field => { "[@metadata][zeek_stun_result]" => "Success" } }
    } else if ([zeek][stun][class] == "RESPONSE_ERROR") {
      if ([zeek][stun][attr_type] == "ERROR_CODE") and ([zeek][stun][attr_val]) {
      mutate { id => "mutate_add_field_zeek_stun_error_attr_val"
               add_field => { "[@metadata][zeek_stun_result]" => "%{[zeek][stun][attr_val]}" } }
      } else {
        mutate { id => "mutate_add_field_zeek_stun_error"
                 add_field => { "[@metadata][zeek_stun_result]" => "Error" } }
      }
    } else if ([zeek][stun][class] != "REQUEST") {
      mutate { id => "mutate_add_field_zeek_stun_result_other"
               add_field => { "[@metadata][zeek_stun_result]" => "%{[zeek][stun][class]}" } }
    }
    if ([@metadata][zeek_stun_result]) {
          mutate { id => "mutate_merge_zeek_stun_mapped_result"
                   merge => { "[event][result]" => "[@metadata][zeek_stun_result]" } }
    }
  }

  if ([zeek][tftp]) {

    if (![zeek][tftp][error_code]) and (![zeek][tftp][error_msg]) {
      # no error, set as "success"
      mutate { id => "mutate_add_field_zeek_tftp_result_success"
               add_field => { "[@metadata][zeek_tftp_result_success]" => "Success" } }
      mutate { id => "mutate_merge_zeek_tftp_result_success"
                merge => { "[event][result]" => "[@metadata][zeek_tftp_result_success]" } }

    } else {
      # normalized version of reply code
      translate {
        id => "translate_zeek_tftp_error_code"
        source => "[zeek][tftp][error_code]"
        target => "[@metadata][zeek_tftp_mapped_result]"
        dictionary_path => "/etc/tftp_result_codes.yaml"
      }
      if ([@metadata][zeek_tftp_mapped_result]) {
        mutate { id => "mutate_merge_zeek_tftp_mapped_result"
                 merge => { "[event][result]" => "[@metadata][zeek_tftp_mapped_result]" } }
      } else if ([zeek][tftp][error_msg]) {
        mutate { id => "mutate_merge_zeek_tftp_error_msg_result"
                 merge => { "[event][result]" => "[zeek][tftp][error_msg]" } }
      } else {
        mutate { id => "mutate_merge_zeek_tftp_error_code_result"
                 merge => { "[event][result]" => "[zeek][tftp][error_code]" } }
      }
    }
  }

  #####################################################################################################################
  # standardization of result

  if ([event][result]) {
    # ECS - event.result -> event.outcome
    # TODO: this gets very granular and varies wildly per protocol, not sure I can translate these 100% from event.action and event.result
    # event.type - https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-type.html
    # event.outcome - https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-outcome.html
    # Eeesh, this is a swag...
    # if ([event][result]) {
    #   ruby {
    #     id => "ruby_ecs_event_outcome_zeek_result"
    #     code => "
    #       event.get('[event][result]').each { |zeekResult|
    #         zeekResult.downcase!
    #         if zeekResult =~ /(abo?rt|bad|busy|close|conflict|crit|declin|denied|deny|disabl|discon|down|err|exceed|exhaust|expir|fail|forbid|illeg|imposs|inappr|incorr|insuff|interrupt|misdirected|nak|no[ _-]*such|overload|problem|refus|reject|terminat|timeout|violat|wrong|(im|dis|mis|un|un|not)[ _-]*(avail|allow|assign|auth|deciph|process|permit|found|support|exist|enough|implem|known|ok|okay|reach|respond|consist|access|satis|succes|valid|want)|too[ _-]*(large|long|small|short|early|late|many|few))/
    #           event.set('[event][outcome]', 'failure')
    #           break
    #         elsif zeekResult =~ /(ok|okay|success|ack|complet|correct|good|ready|finish|valid)/
    #           event.set('[event][outcome]', 'success')
    #           break
    #         end
    #       }
    #     "
    #   }
    # }
  }

  # FUIDs #############################################################################################################
  # collect all other FUIDs under parent [zeek][fuid] array (some were already done at the root level in
  # the "rename" in 1200_zeek_mutate.conf)

  if ([zeek][files][parent_fuid])                { mutate { id => "mutate_merge_normalize_zeek_files_parent_fuid"
                                                           merge => { "[zeek][fuid]" => "[zeek][files][parent_fuid]" } } }

  if ([zeek][http][orig_fuids])                  { mutate { id => "mutate_merge_normalize_zeek_http_orig_fuids"
                                                           merge => { "[zeek][fuid]" => "[zeek][http][orig_fuids]" } } }

  if ([zeek][http][resp_fuids])                  { mutate { id => "mutate_merge_normalize_zeek_http_resp_fuids"
                                                           merge => { "[zeek][fuid]" => "[zeek][http][resp_fuids]" } } }

  if ([zeek][kerberos][client_cert_fuid])        { mutate { id => "mutate_merge_normalize_zeek_kerberos_client_cert_fuid"
                                                           merge => { "[zeek][fuid]" => "[zeek][kerberos][client_cert_fuid]" } } }

  if ([zeek][kerberos][server_cert_fuid])        { mutate { id => "mutate_merge_normalize_zeek_kerberos_server_cert_fuid"
                                                           merge => { "[zeek][fuid]" => "[zeek][kerberos][server_cert_fuid]" } } }

  if ([zeek][ssl][cert_chain_fuids])             { mutate { id => "mutate_merge_normalize_zeek_ssl_cert_chain_fuids"
                                                           merge => { "[zeek][fuid]" => "[zeek][ssl][cert_chain_fuids]" } } }

  if ([zeek][ssl][client_cert_chain_fuids])      { mutate { id => "mutate_merge_normalize_zeek_ssl_client_cert_chain_fuids"
                                                           merge => { "[zeek][fuid]" => "[zeek][ssl][client_cert_chain_fuids]" } } }

  if ([zeek][fuid]) {
    ruby {
      id => "ruby_zeek_fuid_uniq"
      path => "/usr/share/logstash/malcolm-ruby/make_unique_array.rb"
      script_params => {
        "field" => "[zeek][fuid]"
      }
    }
    # ECS - zeek.fuid -> event.id
    mutate { id => "mutate_add_field_ecs_id_fuid"
             merge => { "[event][id]" => "[zeek][fuid]" } }
  }

  # add hart-ip linkages to event.ID as well
  if ([zeek][hart_ip][command_number_link_id]) {
    mutate { id => "mutate_add_field_ecs_id_hart_ip_command_number_link_id"
             merge => { "[event][id]" => "[zeek][hart_ip][command_number_link_id]" } }
  }
  if ([zeek][hart_ip][direct_pdu_command_link_id]) {
    mutate { id => "mutate_add_field_ecs_id_hart_ip_direct_pdu_command_link_id"
             merge => { "[event][id]" => "[zeek][hart_ip][direct_pdu_command_link_id]" } }
  }
  if ([zeek][hart_ip][session_log_record_link_id]) {
    mutate { id => "mutate_add_field_ecs_id_hart_ip_session_log_record_link_id"
             merge => { "[event][id]" => "[zeek][hart_ip][session_log_record_link_id]" } }
  }

  # File/MIME types ###################################################################################################
  # ECS -> various -> file.mime_type
  # collect all file/MIME types under the parent [file][mime_type] array

  if ([zeek][files][mime_type])                  { mutate { id => "mutate_merge_normalize_zeek_files_mime_type"
                                                           merge => { "[file][mime_type]" => "[zeek][files][mime_type]" } } }

  if ([zeek][ftp][mime_type])                    { mutate { id => "mutate_merge_normalize_zeek_ftp_mime_type"
                                                           merge => { "[file][mime_type]" => "[zeek][ftp][mime_type]" } } }

  if ([zeek][http][orig_mime_types])             { mutate { id => "mutate_merge_normalize_zeek_http_orig_mime_types"
                                                           merge => { "[file][mime_type]" => "[zeek][http][orig_mime_types]" } } }

  if ([zeek][http][resp_mime_types])             { mutate { id => "mutate_merge_normalize_zeek_http_resp_mime_types"
                                                           merge => { "[file][mime_type]" => "[zeek][http][resp_mime_types]" } } }

  if ([zeek][irc][dcc_mime_type])                { mutate { id => "mutate_merge_normalize_zeek_irc_dcc_mime_type"
                                                           merge => { "[file][mime_type]" => "[zeek][irc][dcc_mime_type]" } } }

  if ([zeek][intel][file_mime_type])             { mutate { id => "mutate_merge_normalize_zeek_intel_file_mime_type"
                                                           merge => { "[file][mime_type]" => "[zeek][intel][file_mime_type]" } } }

  if ([zeek][notice][file_mime_type])            { mutate { id => "mutate_merge_normalize_zeek_notice_file_mime_type"
                                                           merge => { "[file][mime_type]" => "[zeek][notice][file_mime_type]" } } }

  if ([zeek][sip][content_type])                 { mutate { id => "mutate_merge_normalize_zeek_sip_content_type"
                                                           merge => { "[file][mime_type]" => "[zeek][sip][content_type]" } } }

  # Filenames #########################################################################################################
  # collect all filenames under the parent [file][path] array
  # ECS file.directory, file.name, file.path (https://www.elastic.co/guide/en/ecs/current/ecs-file.html)
  # - file.directory - directory where the file is located, including the drive letter when appropriate
  # - file.name - name of the file including the extension, without the directory
  # - file.path - full path to the file, including the file name, including the drive letter when appropriate
  # Zeek's double backslashes should have already been handled by this point (see uses of dedoubleslash.rb)
  # In the enrichment pipeline during normalization these fields will be used to construct each other.

  if ([zeek][ecat_foe_info][filename])           { mutate { id => "mutate_merge_normalize_zeek_ecat_foe_info_filename"
                                                           merge => { "[file][path]" => "[zeek][ecat_foe_info][filename]" } } }

  if ([zeek][files][filename])                   { mutate { id => "mutate_merge_normalize_zeek_files_filename"
                                                           merge => { "[file][path]" => "[zeek][files][filename]" } } }

  if ([zeek][files][extracted])                  { mutate { id => "mutate_merge_normalize_zeek_files_extracted"
                                                           merge => { "[file][path]" => "[zeek][files][extracted]" } } }

  if ([zeek][http][orig_filenames])              { mutate { id => "mutate_merge_normalize_zeek_http_orig_filenames"
                                                           merge => { "[file][path]" => "[zeek][http][orig_filenames]" } } }

  if ([zeek][http][resp_filenames])              { mutate { id => "mutate_merge_normalize_zeek_http_resp_filenames"
                                                           merge => { "[file][path]" => "[zeek][http][resp_filenames]" } } }

  if ([zeek][s7comm_upload_download][filename])  { mutate { id => "mutate_merge_normalize_zeek_s7comm_upload_download_filename"
                                                            merge => { "[file][path]" => "[zeek][s7comm_upload_download][filename]" } } }

  if ([zeek][omron_fins_file][volume_label])     { mutate { id => "mutate_merge_normalize_zeek_omron_fins_file_volume_label"
                                                            merge => { "[file][path]" => "[zeek][omron_fins_file][volume_label]" } } }

  if ([zeek][omron_fins_file][file_name])        { mutate { id => "mutate_merge_normalize_zeek_omron_fins_file_file_name"
                                                            merge => { "[file][path]" => "[zeek][omron_fins_file][file_name]" } } }

  # as we already did a bunch of work parsing out smb.host, smb.share and smb.filename in 12_zeek_mutate.conf, use those here as well
  # this should cover smb_files, smb_cmd and smb_mapping
  if [smb] {
    ruby {
      id => "ruby_zeek_smb_ecs_file_normalize"
      code => "
        fileName = Array.new unless (fileName = event.get('[file][name]'))
        fileDir = Array.new unless (fileDir = event.get('[file][directory]'))
        filePath = Array.new unless (filePath = event.get('[file][path]'))

        smbHost = event.get('[smb][host]')
        smbShare = event.get('[smb][share]')
        smbFile = event.get('[smb][filename]')
        smbHost = Array(smbHost).first.prepend('\\\\') unless smbHost.nil? or (smbHost.length == 0)
        smbShare = Array(smbShare).first.delete_prefix('\\').delete_suffix('\\') unless smbShare.nil? or (smbShare.length == 0)
        smbFile = Array(smbFile).first.delete_prefix('\\') unless smbFile.nil? or (smbFile.length == 0)

        fullParts = [smbHost, smbShare, smbFile].reject{ |e| e.nil? || e&.empty? }
        filePath << fullParts.join('\\')
        fileDir << [smbHost, smbShare].reject{ |e| e.nil? || e&.empty? }.join('\\')
        if !smbFile.nil? and (smbFile.length > 0) then
          fileName << fullParts.last
        end

        event.set('[file][path]', filePath) unless filePath.nil? or (filePath.length == 0)
        event.set('[file][directory]', fileDir) unless fileDir.nil? or (fileDir.length == 0)
        event.set('[file][name]', fileName) unless fileName.nil? or (fileName.length == 0)
      "
    }
  }

  # if we have a network protocol as a "source" field for zeek files.log, also store in protocols
  if ([zeek][files][source]) and
     (![network][protocol]) and
     ([zeek][files][source] !~ /^(<error|PNG|XOR|ZIP)/) {
    mutate { id => "mutate_merge_zeek_files_source_network_protocol"
             merge => { "[network][protocol]" => "[zeek][files][source]" } }
    mutate { id => "mutate_lowercase_zeek_files_source_network_protocol"
             lowercase => [ "[network][protocol]" ] }
    mutate { id => "mutate_merge_zeek_files_source_protocol"
             merge => { "[protocol]" => "[network][protocol]" } }
  }

  # File/file source #####################################################################################################
  # ECS -> various -> file.source
  # collect file source under file.source
  if ([zeek][files][source]) { mutate { id => "mutate_suricata_rename_zeek_files_source"
                                        rename => { "[zeek][files][source]" => "[file][source]" } } }

  # User agents #######################################################################################################
  # ECS -> various -> user_agent.original (https://www.elastic.co/guide/en/ecs/current/ecs-user_agent.html)
  #     - TODO: potentially more parsing could be done for user agent strings (.name, .device.name, .version)
  if ([zeek][gquic][user_agent]) { mutate { id => "mutate_merge_ecs_useragent_gquic"
                                            merge => { "[user_agent][original]" => "[zeek][gquic][user_agent]" } } }
  if ([zeek][http][user_agent]) {  mutate { id => "mutate_merge_ecs_useragent_http"
                                            merge => { "[user_agent][original]" => "[zeek][http][user_agent]" } } }
  if ([zeek][sip][user_agent]) {   mutate { id => "mutate_merge_ecs_useragent_sip"
                                            merge => { "[user_agent][original]" => "[zeek][sip][user_agent]" } } }
  if ([zeek][smtp][user_agent]) {  mutate { id => "mutate_merge_ecs_useragent_smtp"
                                            merge => { "[user_agent][original]" => "[zeek][smtp][user_agent]" } } }
  if ([zeek][websocket][user_agent]) {  mutate { id => "mutate_merge_ecs_useragent_websocket"
                                            merge => { "[user_agent][original]" => "[zeek][websocket][user_agent]" } } }

  # Hashes ############################################################################################################
  # ECS - various -> related.hash (accumulate all hash/fingerprint fields into related.hash)
  if ([zeek][conn][ja4l]) {                      mutate { id => "mutate_merge_field_related_hash_tcp_ja4l"
                                                          merge => { "[related][hash]" => "[zeek][conn][ja4l]" } } }
  if ([zeek][conn][ja4ls]) {                     mutate { id => "mutate_merge_field_related_hash_tcp_ja4ls"
                                                          merge => { "[related][hash]" => "[zeek][conn][ja4ls]" } } }
  if ([zeek][conn][ja4t]) {                      mutate { id => "mutate_merge_field_related_hash_tcp_ja4t"
                                                          merge => { "[related][hash]" => "[zeek][conn][ja4t]" } } }
  if ([zeek][conn][ja4ts]) {                     mutate { id => "mutate_merge_field_related_hash_tcp_ja4ts"
                                                          merge => { "[related][hash]" => "[zeek][conn][ja4ts]" } } }
  if ([zeek][files][md5]) {                      mutate { id => "mutate_merge_field_related_hash_files_md5"
                                                          merge => { "[related][hash]" => "[zeek][files][md5]" } } }
  if ([zeek][files][sha1]) {                     mutate { id => "mutate_merge_field_related_hash_files_sha1"
                                                          merge => { "[related][hash]" => "[zeek][files][sha1]" } } }
  if ([zeek][files][sha256]) {                   mutate { id => "mutate_merge_field_related_hash_files_sha256"
                                                          merge => { "[related][hash]" => "[zeek][files][sha256]" } } }
  if ([zeek][http][ja4h]) {                      mutate { id => "mutate_merge_field_related_hash_http_ja4h"
                                                         merge => { "[related][hash]" => "[zeek][http][ja4h]" } } }
  if ([zeek][ssh][hassh]) {                      mutate { id => "mutate_merge_field_related_hash_ssh_hassh"
                                                          merge => { "[related][hash]" => "[zeek][ssh][hassh]" } } }
  if ([zeek][ssh][hasshServer]) {                mutate { id => "mutate_merge_field_related_hash_ssh_hasshServer"
                                                          merge => { "[related][hash]" => "[zeek][ssh][hasshServer]" } } }
  if ([zeek][ssh][ja4ssh]) {                     mutate { id => "mutate_merge_field_related_hash_ssh_ja4ssh"
                                                          merge => { "[related][hash]" => "[zeek][ssh][ja4ssh]" } } }                                                       
  if ([zeek][ssl][ja4]) {                        mutate { id => "mutate_merge_field_related_hash_ssl_ja4"
                                                          merge => { "[related][hash]" => "[zeek][ssl][ja4]" } } }
  if ([zeek][ssl][ja4s]) {                       mutate { id => "mutate_merge_field_related_hash_ssl_ja4s"
                                                          merge => { "[related][hash]" => "[zeek][ssl][ja4s]" } } }
  if ([zeek][x509][fingerprint]) {               mutate { id => "mutate_merge_field_related_hash_zeek_x509_fingerprint"
                                                          merge => { "[related][hash]" => "[zeek][x509][fingerprint]" } } }

  # Hosts and domains #################################################################################################
  # ECS - various -> related.hosts (a lot of these are actually done in the enrichment pipeline)
  if ([zeek][gquic][server_name]) {              mutate { id => "mutate_merge_field_zeek_gquic_server_name_related_hosts"
                                                          merge => { "[related][hosts]" => "[zeek][gquic][server_name]" } } }

  if ([zeek][smtp][helo]) {                      mutate { id => "mutate_merge_field_zeek_smtp_helo_related_hosts"
                                                          merge => { "[related][hosts]" => "[zeek][smtp][helo]" } } }

  if ([zeek][websocket][host]) {                 mutate { id => "mutate_merge_field_zeek_websocket_related_hosts"
                                                          merge => { "[related][hosts]" => "[zeek][websocket][host]" } } }

  # URLs/URIs #########################################################################################################
  # ECS - various -> url.original

  if ([zeek][opcua_binary][log_types]) {
    # OPCUA has a TON of URL/URI types, let's just get them all at once based
    # on the key name =~ /_ur[il](_str(ing))?/
    ruby {
      id => "ruby_zeek_opcua_binary_all_uris"
      code => '
        urls = Array.new unless (urls = event.get("[url][original]"))
        zeekVals = event.get("[zeek]")
        if !zeekVals.nil? and (zeekVals.length > 0) then
          flattened = (q = zeekVals.to_a).select { |key, value|
            value = (1..value.size).zip(value).to_h if value.is_a? Array
            !value.is_a?(Hash) || !value.each { |k, v| q << ["#{key}.#{k}", v] }
          }.to_h.select { |key, value| value.is_a?String and (key =~ /opcua/) and (key !~ /\.has_/) and (!(key =~ /_ur[il](_str(ing))?$/).nil?) }.values.uniq
          urls.concat(flattened) unless flattened.nil? or (flattened.length == 0)
        end
        event.set("[url][original]", urls) unless urls.nil? or (urls.length == 0)
      '
    }
  }

  if ([zeek][software][url]) {                                                    mutate { id => "mutate_merge_field_zeek_software_url_url_original"
                                                                                           merge => { "[url][original]" => "[zeek][software][url]" } } }

  if ([zeek][sip][uri]) {                                                         mutate { id => "mutate_merge_field_zeek_sip_uri_url_original"
                                                                                           merge => { "[url][original]" => "[zeek][sip][uri]" } } }

  if ([zeek][websocket][uri]) {                                                   mutate { id => "mutate_merge_field_zeek_websocket_uri_url_original"
                                                                                           merge => { "[url][original]" => "[zeek][websocket][uri]" } } }

  if ([zeek][x509][san_uri]) {                                                    mutate { id => "mutate_merge_field_zeek_x509_san_uri_url_original"
                                                                                           merge => { "[url][original]" => "[zeek][x509][san_uri]" } } }

  # MAC addresses #####################################################################################################
  # ECS - various -> related.mac (all MAC address fields get rolled up into related.mac)
  if ([zeek][dhcp][mac]) {           mutate { id => "mutate_merge_field_related_mac_zeek_dhcp_mac"
                                              merge => { "[related][mac]" => "[zeek][dhcp][mac]" } } }
  if ([zeek][radius][mac]) {         mutate { id => "mutate_merge_field_related_mac_zeek_radius_mac"
                                              merge => { "[related][mac]" => "[zeek][radius][mac]" } } }

  # IP addresses ######################################################################################################
  # ECS - various -> related.ip (all IP-type fields get rolled up into related.ip)
  if ([zeek][dhcp][assigned_ip]) {              mutate { id => "mutate_merge_field_related_ip_zeek_dhcp_assigned_ip"
                                                         merge => { "[related][ip]" => "[zeek][dhcp][assigned_ip]" } } }
  if ([zeek][dhcp][requested_ip]) {             mutate { id => "mutate_merge_field_related_ip_zeek_dhcp_requested_ip"
                                                         merge => { "[related][ip]" => "[zeek][dhcp][requested_ip]" } } }
  if ([zeek][files][rx_hosts]) {                mutate { id => "mutate_merge_field_related_ip_zeek_files_rx_hosts"
                                                         merge => { "[related][ip]" => "[zeek][files][rx_hosts]" } } }
  if ([zeek][files][tx_hosts]) {                mutate { id => "mutate_merge_field_related_ip_zeek_files_tx_hosts"
                                                         merge => { "[related][ip]" => "[zeek][files][tx_hosts]" } } }
  if ([zeek][ftp][data_channel][orig_h]) {      mutate { id => "mutate_merge_field_related_ip_zeek_ftp_data_channel_orig_h"
                                                         merge => { "[related][ip]" => "[zeek][ftp][data_channel][orig_h]" } } }
  if ([zeek][ftp][data_channel][resp_h]) {      mutate { id => "mutate_merge_field_related_ip_zeek_ftp_data_channel_resp_h"
                                                         merge => { "[related][ip]" => "[zeek][ftp][data_channel][resp_h]" } } }
  if ([zeek][hart_ip_session_record][session_log_record_client_i_pv4_address]) {
    mutate { id => "mutate_merge_field_related_ip_zeek_hart_ip_session_record_session_log_record_client_i_pv4_address"
             merge => { "[related][ip]" => "[zeek][hart_ip_session_record][session_log_record_client_i_pv4_address]" } }
  }
  if ([zeek][hart_ip_session_record][session_log_record_client_i_pv6_address]) {
    mutate { id => "mutate_merge_field_related_ip_zeek_hart_ip_session_record_session_log_record_client_i_pv6_address"
             merge => { "[related][ip]" => "[zeek][hart_ip_session_record][session_log_record_client_i_pv6_address]" } }
  }
  if ([zeek][notice][dst]) {                    mutate { id => "mutate_merge_field_related_ip_zeek_notice_dst"
                                                         merge => { "[related][ip]" => "[zeek][notice][dst]" } } }
  if ([zeek][notice][src]) {                    mutate { id => "mutate_merge_field_related_ip_zeek_notice_src"
                                                         merge => { "[related][ip]" => "[zeek][notice][src]" } } }
  if ([zeek][ospf][router_id]) {                mutate { id => "mutate_merge_field_related_ip_zeek_ospf_router_id"
                                                          merge => { "[related][ip]" => "[zeek][ospf][router_id]" } } }
  if ([zeek][ospf][desig_router]) {             mutate { id => "mutate_merge_field_related_ip_zeek_ospf_desig_router"
                                                         merge => { "[related][ip]" => "[zeek][ospf][desig_router]" } } }
  if ([zeek][ospf][backup_router]) {            mutate { id => "mutate_merge_field_related_ip_zeek_ospf_backup_router"
                                                         merge => { "[related][ip]" => "[zeek][ospf][backup_router]" } } }
  if ([zeek][ospf][neighbors]) {                mutate { id => "mutate_merge_field_related_ip_zeek_ospf_neighbors"
                                                         merge => { "[related][ip]" => "[zeek][ospf][neighbors]" } } }
  if ([zeek][ospf][advert_router]) {            mutate { id => "mutate_merge_field_related_ip_zeek_ospf_advert_router"
                                                         merge => { "[related][ip]" => "[zeek][ospf][advert_router]" } } }
  if ([zeek][ospf][routers]) {                  mutate { id => "mutate_merge_field_related_ip_zeek_ospf_routers"
                                                         merge => { "[related][ip]" => "[zeek][ospf][routers]" } } }
  if ([zeek][ospf][link_id]) {                  mutate { id => "mutate_merge_field_related_ip_zeek_ospf_link_id"
                                                         merge => { "[related][ip]" => "[zeek][ospf][link_id]" } } }
  if ([zeek][ospf][link_data]) {                mutate { id => "mutate_merge_field_related_ip_zeek_ospf_link_data"
                                                         merge => { "[related][ip]" => "[zeek][ospf][link_data]" } } }
  if ([zeek][ospf][neighbor_router_id]) {       mutate { id => "mutate_merge_field_related_ip_zeek_ospf_neighbor_router_id"
                                                         merge => { "[related][ip]" => "[zeek][ospf][neighbor_router_id]" } } }
  if ([zeek][ospf][fwd_addrs]) {                mutate { id => "mutate_merge_field_related_ip_zeek_ospf_fwd_addrs"
                                                         merge => { "[related][ip]" => "[zeek][ospf][fwd_addrs]" } } }
  if ([zeek][ospf][dest_router_id]) {           mutate { id => "mutate_merge_field_related_ip_zeek_ospf_dest_router_id"
                                                         merge => { "[related][ip]" => "[zeek][ospf][dest_router_id]" } } }
  if ([zeek][smb_files][orig_h]) {              mutate { id => "mutate_merge_field_related_ip_zeek_smb_files_orig_h"
                                                         merge => { "[related][ip]" => "[zeek][smb_files][orig_h]" } } }
  if ([zeek][smb_files][resp_h]) {              mutate { id => "mutate_merge_field_related_ip_zeek_smb_files_resp_h"
                                                         merge => { "[related][ip]" => "[zeek][smb_files][resp_h]" } } }
  if ([zeek][radius][framed_addr]) {            mutate { id => "mutate_merge_field_related_ip_zeek_radius_framed_addr"
                                                         merge => { "[related][ip]" => "[zeek][radius][framed_addr]" } } }
  if ([zeek][smtp][path]) {                     mutate { id => "mutate_merge_field_related_ip_zeek_smtp_path"
                                                         merge => { "[related][ip]" => "[zeek][smtp][path]" } } }
  if ([zeek][smtp][x_originating_ip]) {         mutate { id => "mutate_merge_field_related_ip_zeek_smtp_x_originating_ip"
                                                         merge => { "[related][ip]" => "[zeek][smtp][x_originating_ip]" } } }
  if ([zeek][socks][bound_host]) {              mutate { id => "mutate_merge_field_related_ip_zeek_socks_bound_host"
                                                         merge => { "[related][ip]" => "[zeek][socks][bound_host]" } } }
  if ([zeek][socks][request_host]) {            mutate { id => "mutate_merge_field_related_ip_zeek_socks_request_host"
                                                         merge => { "[related][ip]" => "[zeek][socks][request_host]" } } }
  if ([zeek][stun_nat][wan_addr]) {             mutate { id => "mutate_merge_field_related_ip_zeek_stun_nat_wan_addr"
                                                         merge => { "[related][ip]" => "[zeek][stun_nat][wan_addr]" } } }
  if ([zeek][stun_nat][lan_addr]) {             mutate { id => "mutate_merge_field_related_ip_zeek_stun_nat_lan_addr"
                                                         merge => { "[related][ip]" => "[zeek][stun_nat][lan_addr]" } } }

}