work in progress incorporating icsnpp-profinet-io-cm, idaholab#429

mmguero-dev · Feb 27, 2024 · 09cf72d · 09cf72d
1 parent d1718b1
commit 09cf72d
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/logstash/pipelines/zeek/11_zeek_parse.conf b/logstash/pipelines/zeek/11_zeek_parse.conf
@@ -2709,6 +2709,13 @@ filter {
                split => { "[zeek_cols][sel_ack]" => "," } }
     }
 
+    if ([zeek_cols][packet_type]) and ((![zeek_cols][operation])       or ([zeek_cols][operation] == '(empty)') or
+                                       ([zeek_cols][operation] == 'unknown') or ([zeek_cols][operation] == '-') or
+                                       ([zeek_cols][operation] == '')) {
+      mutate { id => "mutate_replace_zeek_profinet_io_cm_operation"
+               replace => { "[zeek_cols][operation]" => "%{[zeek_cols][packet_type]}" } }
+    }
+
     mutate {
       id => "mutate_add_fields_zeek_profinet_io_cm"
       add_field => {