beats.yml

processors:
- timestamp:
    field: some_timestamp_field
    target_field: "@timestamp"
    layouts: UNIX_MS
    timezone: UTC
    ignore_missing: true
    ignore_failure: true
- timestamp:
    field: some_other_timestamp
    target_field: "@timestamp"
    layouts: UNIX_MS
    timezone: UTC
    ignore_missing: true
    ignore_failure: true
- timestamp:
    field: some_new_timestamp
    target_field: destination_timestamp
    layouts: UNIX
    timezone: UTC
    ignore_missing: true
    ignore_failure: true
- copy_fields:
    fields:
    - from: srcip
      to: source.address
    - from: srcip
      to: source.ip
    - from: new_event.srcip
      to: source.ip
    - from: destip
      to: destination.address
    - from: destport
      to: destination.port
    - from: ts
      to: timestamp
    ignore_missing: true
    fail_on_error: false
- rename:
    fields:
    - from: srcport
      to: source.port
    - from: action
      to: event.action
    - from: duration
      to: event.duration
    - from: user_agent
      to: user_agent.original
    - from: log_level
      to: log.level
    - from: eventid
      to: event.id
    - from: hostip
      to: host.ip
    ignore_missing: true
    fail_on_error: false
- convert:
    fields:
    - from: source.port
      type: long
    - from: destination.port
      type: long
    - from: event.duration
      type: float
    - from: event.id
      type: string
    ignore_missing: true
    fail_on_error: false