corelight.conf

# Product: Corelight
# Category: NDR
# Supported Format: JSON
# Reference: See below
# Last Updated: 2024-09-20
# Copyright 2023 Chronicle LLC

filter {
  # Initialize log source specific fields that are needed for conditional or convert operations
  mutate {
    replace => {
      "_path" => ""
    }
  }

  # Remove syslog header
  # - if using JSON over Syslog
  grok {
    match => {
      "message" => [ "(?P<message>\{.*\})$" ]
    }
    on_error => "_grok_not_syslog"
    overwrite => [ "message" ]
  }

  # These fields may dropped after parsing JSON so changing their labels
  mutate {
    gsub => ["message", '"mgmt.in.bytes.mbps"', '"mgmt.in.bytes_mbps"']
  }
  mutate {
    gsub => ["message", '"mgmt.out.bytes.mbps"', '"mgmt.out.bytes_mbps"']
  }
  mutate {
    gsub => ["message", '"mgmt.in.packets.kpps"', '"mgmt.in.packets_kpps"']
  }
  mutate {
    gsub => ["message", '"mgmt.out.packets.kpps"', '"mgmt.out.packets_kpps"']
  }
  mutate {
    gsub => ["message", '"monitor.total.drops.kpps"',
    '"monitor.total.drops_kpps"']
  }
  mutate {
    gsub => ["message", '"cpu"', '"bro_cpu"']
  }

  # Parse JSON log
  json {
    on_error => "not_json"
    source => "message"
    array_function => "split_columns"
  }

  if [not_json] or [_path] == "" {
    drop {
      "tag" => "TAG_MALFORMED_ENCODING"
    }
  }

  # Initialize empty fields for validation
  mutate {
    replace => {
      "principal_present" => "false"
      "target_present" => "false"
    }
  }

  # Mapping for common fields
  mutate {
    replace => {
      "token_metadata.vendor_name" => "Corelight"
    }
  }

  mutate {
    replace => {
      "token_metadata.product_name" => "Zeek"
    }
  }

  # Map metadata.event_type as a GENERIC.
  mutate {
    replace => {
      "token_metadata.event_type" => "GENERIC_EVENT"
    }
  }

  # Parse date.
  date {
    match => ["ts", "RFC3339" ]
    on_error => "ts_not_found"
  }

  date {
    match => ["_write_ts", "RFC3339"]
    target => "token_metadata.collected_timestamp"
    on_error => "write_ts_not_found"
  }

  mutate {
    replace => {
      "uid_present" => "%{uid}"
    }
    on_error => "uid_not_found"
  }

  if ![uid_not_found] and [uid] != "" {
    mutate {
      replace => {
        "uid_labels.key" => "uid"
      }
    }
    mutate {
      replace => {
        "uid_labels.value" => "%{uid}"
      }
    }
  }

  mutate {
    replace => {
      "token_metadata.product_event_type" => "%{_path}"
    }
    on_error => "_path_not_found"
  }

  if [_path] not in ["intel","known_certs","known_devices","known_domains",
  "known_hosts","known_names","known_remotes",
  "known_services","known_users"] {
    mutate {
      convert => {
        "id.vlan" => "string"
      }
      on_error => "id_vlan_conversion_error"
    }

    mutate {
      replace => {
        "id_vlan_label.value.string_value" => "%{id.vlan}"
      }
      on_error => "id_vlan_not_found"
    }

    if ![id_vlan_not_found] and
      [id_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_vlan_label.key" => "id_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "id.vlan_inner" => "string"
      }
      on_error => "id_vlan_inner_conversion_error"
    }

    mutate {
      replace => {
        "id_vlan_inner_label.value.string_value" => "%{id.vlan_inner}"
      }
      on_error => "id_vlan_inner_not_found"
    }

    if ![id_vlan_inner_not_found] and
      [id_vlan_inner_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_vlan_inner_label.key" => "id_vlan_inner"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_vlan_inner_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_cid" => "string"
      }
      on_error => "id_orig_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_cid_label.value.string_value" => "%{id.orig_ep_cid}"
      }
      on_error => "id_orig_ep_cid_not_found"
    }

    if ![id_orig_ep_cid_not_found] and
      [id_orig_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_cid_label.key" => "id_orig_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_source" => "string"
      }
      on_error => "id_orig_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_source_label.value.string_value" =>
        "%{id.orig_ep_source}"
      }
      on_error => "id_orig_ep_source_not_found"
    }

    if ![id_orig_ep_source_not_found] and
      [id_orig_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_source_label.key" => "id_orig_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_status" => "string"
      }
      on_error => "id_orig_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_status_label.value.string_value" =>
        "%{id.orig_ep_status}"
      }
      on_error => "id_orig_ep_status_not_found"
    }

    if ![id_orig_ep_status_not_found] and
      [id_orig_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_status_label.key" => "id_orig_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_uid" => "string"
      }
      on_error => "id_orig_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_uid_label.value.string_value" => "%{id.orig_ep_uid}"
      }
      on_error => "id_orig_ep_uid_not_found"
    }

    if ![id_orig_ep_uid_not_found] and
      [id_orig_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_uid_label.key" => "id_orig_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_uid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_cid" => "string"
      }
      on_error => "id_resp_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_cid_label.value.string_value" => "%{id.resp_ep_cid}"
      }
      on_error => "id_resp_ep_cid_not_found"
    }

    if ![id_resp_ep_cid_not_found] and
      [id_resp_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_cid_label.key" => "id_resp_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_source" => "string"
      }
      on_error => "id_resp_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_source_label.value.string_value" =>
        "%{id.resp_ep_source}"
      }
      on_error => "id_resp_ep_source_not_found"
    }

    if ![id_resp_ep_source_not_found] and
      [id_resp_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_source_label.key" => "id_resp_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_status" => "string"
      }
      on_error => "id_resp_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_status_label.value.string_value" =>
        "%{id.resp_ep_status}"
      }
      on_error => "id_resp_ep_status_not_found"
    }

    if ![id_resp_ep_status_not_found] and
      [id_resp_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_status_label.key" => "id_resp_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_uid" => "string"
      }
      on_error => "id_resp_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_uid_label.value.string_value" => "%{id.resp_ep_uid}"
      }
      on_error => "id_resp_ep_uid_not_found"
    }

    if ![id_resp_ep_uid_not_found] and
      [id_resp_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_uid_label.key" => "id_resp_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_uid_label"
        }
      }
    }
  }

  # UDM > Observer > Hostname
  # - the Corelight sensor itself
  mutate {
    replace => {
      "token_observer.hostname" => "%{_system_name}"
    }
    on_error => "_system_name_not_found"
  }

  # UDM > Principal > IP
  mutate {
    replace => {
      "principal_ip" => "%{id.orig_h}"
    }
    on_error => "id_orig_h_not_found"
  }
  mutate {
    convert => {
      "principal_ip" => "ipaddress"
    }
    on_error => "not_valid_ip"
  }
  if ![not_valid_ip] {
    mutate {
      merge => {
        "token_principal.ip" => "id.orig_h"
      }
      on_error => "id_orig_h_not_found"
    }
    if ![id_orig_h_not_found] {
      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }
  }

  # UDM > Principal > Port
  mutate {
    convert => {
      "id.orig_p" => "integer"
    }
    on_error => "not_valid_port"
  }
  if ![not_valid_port] {
    mutate {
      rename => {
        "id.orig_p" => "token_principal.port"
      }
      on_error => "id_orig_p_not_found"
    }
  }

  # UDM > Target > IP
  mutate {
    replace => {
      "target_ip" => "%{id.resp_h}"
    }
    on_error => "id_resp_h_not_found"
  }
  mutate {
    convert => {
      "target_ip" => "ipaddress"
    }
    on_error => "not_valid_ip"
  }
  if ![not_valid_ip] {
    mutate {
      merge => {
        "token_target.ip" => "id.resp_h"
      }
      on_error => "id_resp_h_not_found"
    }
    if ![id_resp_h_not_found] {
      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }
  }

  # UDM > Target > Port
  mutate {
    convert => {
      "id.resp_p" => "integer"
    }
    on_error => "not_valid_port"
  }
  if ![not_valid_port] {
    mutate {
      rename => {
        "id.resp_p" => "token_target.port"
      }
      on_error => "id_resp_p_not_found"
    }
  }

  # ----------------------------------------------------------------------
  # HTTP
  # - The logging model is to log request/response pairs and all relevant metadata together in a single record.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/http/main.zeek.html

  if [_path] == "http" or [_path] == "http_red" or [_path] == "http2" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol_version" => "%{version}"
      }
      on_error => "version_not_found"
    }

    mutate {
      replace => {
        "token_network.http.method" => "%{method}"
      }
      on_error => "method_not_found"
    }

    mutate {
      replace => {
        "token_network.http.referral_url" => "%{referrer}"
      }
      on_error => "referrer_not_found"
    }

    mutate {
      convert => {
        "status_code" => "integer"
      }
      on_error => "status_code_conversion_error"
    }

    if ![status_code_conversion_error] {
      mutate {
        rename => {
          "status_code" => "token_network.http.response_code"
        }
        on_error => "status_code_not_found"
      }
    }

    mutate {
      replace => {
        "token_network.http.user_agent" => "%{user_agent}"
      }
      on_error => "user_agent_not_found"
    }

    mutate {
      convert => {
        "response_body_len" => "uinteger"
      }
      on_error => "response_body_len_conversion_error"
    }
    if ![response_body_len_conversion_error] {
      mutate {
        rename => {
          "response_body_len" => "token_network.received_bytes"
        }
        on_error => "response_body_len_not_found"
      }
    }

    mutate {
      convert => {
        "request_body_len" => "uinteger"
      }
      on_error => "request_body_len_conversion_error"
    }
    if ![request_body_len_conversion_error] {
      mutate {
        rename => {
          "request_body_len" => "token_network.sent_bytes"
        }
        on_error => "request_body_len_not_found"
      }
    }

    # UDM > Principal
    mutate {
      replace => {
        "_" => "%{origin}"
      }
      on_error => "origin_not_found"
    }

    if ![origin_not_found] and [origin] =~ "^(.){1,253}$" {
      mutate {
        replace => {
          "token_principal.hostname" => "%{origin}"
        }
      }
    }

    mutate {
      replace => {
        "token_principal.user.user_display_name" => "%{username}"
      }
      on_error => "username_not_found"
    }

    # UDM > Src
    for index_file,orig_file in orig_filenames {
      if [index_file] == 0 {
        mutate {
          merge => {
            "token_src.file.names" => "orig_file"
          }
          on_error => "orig_file_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "orig_file_about" => ""
          }
        }
        mutate {
          merge => {
            "orig_file_about.file.names" => "orig_file"
          }
          on_error => "orig_filenames_not_found"
        }
        mutate {
          merge => {
            "token_about" => "orig_file_about"
          }
          on_error => "orig_filenames_not_found"
        }
      }
    }

    for index_mime,orig_mime in orig_mime_types {
      if [index_mime] == 0 {
        mutate {
          replace => {
            "token_src.file.mime_type" => "%{orig_mime}"
          }
          on_error => "orig_mime_types_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "orig_file_about" => ""
          }
        }
        mutate {
          replace => {
            "orig_file_about.file.mime_type" => "%{orig_mime}"
          }
          on_error => "orig_filenames_not_found"
        }
        mutate {
          merge => {
            "token_about" => "orig_file_about"
          }
          on_error => "orig_filenames_not_found"
        }
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "_" => "%{host}"
      }
      on_error => "host_not_found"
    }

    if ![host_not_found] and [host] =~ "^(.){1,253}$" {
      mutate {
        replace => {
          "token_target.hostname" => "%{host}"
        }
      }
    }

    mutate {
      replace => {
        "token_target.url" => "%{uri}"
      }
      on_error => "_field_not_found"
    }

    for index_file,resp_filename in resp_filenames {
      if [index_file] == 0 {
        mutate {
          merge => {
            "token_target.file.names" => "resp_filename"
          }
          on_error => "resp_filenames_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "resp_file_about" => ""
          }
        }
        mutate {
          merge => {
            "resp_file_about.file.names" => "resp_filename"
          }
          on_error => "resp_filenames_not_found"
        }
        mutate {
          merge => {
            "token_about" => "resp_file_about"
          }
          on_error => "resp_filenames_not_found"
        }
      }
    }

    for index_type,resp_mime in resp_mime_types {
      if [index_type] == 0 {
        mutate {
          replace => {
            "token_target.file.mime_type" => "%{resp_mime}"
          }
          on_error => "resp_mime_types_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "resp_file_about" => ""
          }
        }
        mutate {
          replace => {
            "resp_file_about.file.mime_type" => "%{resp_mime}"
          }
          on_error => "resp_mime_types_not_found"
        }
        mutate {
          merge => {
            "token_about" => "resp_file_about"
          }
          on_error => "resp_filenames_not_found"
        }
      }
    }

    # UDM > Intermediary

    for proxy in proxied {
      mutate {
        replace => {
          "proxy_intermediary" => ""
        }
      }

      mutate {
        replace => {
          "_" => "%{proxy}"
        }
        on_error => "proxy_not_found"
      }

      if ![proxy_not_found] and [proxy] =~ "^(.){1,253}$" {
        mutate {
          replace => {
            "proxy_intermediary.hostname" => "%{proxy}"
          }
        }
        mutate {
          merge => {
            "token_intermediary" => "proxy_intermediary"
          }
          on_error => "proxy_intermediary_not_found"
        }
      }
    }

    # UDM > Extensions

    mutate {
      replace => {
        "token_extensions.auth.auth_details" => "%{password}"
      }
      on_error => "password_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "http_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    for fuid in orig_fuids {
      mutate {
        replace => {
          "orig_fuid_label" => ""
        }
      }

      mutate {
        replace => {
          "orig_fuid_label.value" => "%{fuid}"
        }
        on_error => "fuid_not_found"
      }
      if ![fuid_not_found] and [fuid] != "" {
        mutate {
          replace => {
            "orig_fuid_label.key" => "orig_fuid"
          }
        }
        mutate {
          merge => {
            "http_token_about.labels" => "orig_fuid_label"
          }
        }
      }
    }

    for rfuid in resp_fuids {
      mutate {
        replace => {
          "resp_fuid_label" => ""
        }
      }

      mutate {
        replace => {
          "resp_fuid_label.value" => "%{rfuid}"
        }
        on_error => "rfuid_not_found"
      }
      if ![rfuid_not_found] and [rfuid] != "" {
        mutate {
          replace => {
            "resp_fuid_label.key" => "resp_fuid"
          }
        }
        mutate {
          merge => {
            "http_token_about.labels" => "resp_fuid_label"
          }
        }
      }
    }

    mutate {
      replace => {
        "encoding_label.value" => "%{encoding}"
      }
      on_error => "encoding_not_found"
    }
    if ![encoding_not_found] and [encoding] != "" {
      mutate {
        replace => {
          "encoding_label.key" => "encoding"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "encoding_label"
        }
      }
    }

    mutate {
      convert => {
        "info_code" => "string"
      }
      on_error => "conversion_error"
    }

    mutate {
      replace => {
        "info_code_label.value" => "%{info_code}"
      }
      on_error => "info_code_not_found"
    }
    if ![info_code_not_found] and [info_code] != "" {
      mutate {
        replace => {
          "info_code_label.key" => "info_code"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "info_code_label"
        }
      }
    }

    mutate {
      replace => {
        "info_msg_label.value" => "%{info_msg}"
      }
      on_error => "info_msg_not_found"
    }
    if ![info_msg_not_found] and [info_msg] != "" {
      mutate {
        replace => {
          "info_msg_label.key" => "info_msg"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "info_msg_label"
        }
      }
    }

    mutate {
      convert => {
        "push" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "push_label.value" => "%{push}"
      }
      on_error => "push_not_found"
    }
    if ![push_not_found] and [push] != "" {
      mutate {
        replace => {
          "push_label.key" => "push"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "push_label"
        }
      }
    }

    mutate {
      replace => {
        "status_msg_label.value" => "%{status_msg}"
      }
      on_error => "status_msg_not_found"
    }
    if ![status_msg_not_found] and [status_msg] != "" {
      mutate {
        replace => {
          "status_msg_label.key" => "status_msg"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "status_msg_label"
        }
      }
    }

    mutate {
      convert => {
        "stream_id" => "string"
      }
      on_error => "stream_id_conversion_error"
    }
    mutate {
      replace => {
        "stream_id_label.value" => "%{stream_id}"
      }
      on_error => "stream_id_not_found"
    }
    if ![stream_id_not_found] and [stream_id] != "" {
      mutate {
        replace => {
          "stream_id_label.key" => "stream_id"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "stream_id_label"
        }
      }
    }

    for tag in tags {
      mutate {
        replace => {
          "tag_label" => ""
        }
      }
      mutate {
        replace => {
          "tag_label.value" => "%{tag}"
        }
        on_error => "tag_not_found"
      }
      if ![tag_not_found] and [tag] != "" {
        mutate {
          replace => {
            "tag_label.key" => "tag"
          }
        }
        mutate {
          merge => {
            "http_token_about.labels" => "tag_label"
          }
        }
      }
    }

    mutate {
      convert => {
        "trans_depth" => "string"
      }
      on_error => "conversion_error"
    }

    mutate {
      replace => {
        "trans_depth_label.value" => "%{trans_depth}"
      }
      on_error => "trans_depth_not_found"
    }
    if ![trans_depth_not_found] and [trans_depth] != "" {
      mutate {
        replace => {
          "trans_depth_label.key" => "trans_depth"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "trans_depth_label"
        }
      }
    }

    mutate {
      replace => {
        "post_body_label.value" => "%{post_body}"
      }
      on_error => "post_body_not_found"
    }
    if ![post_body_not_found] and [post_body] != "" {
      mutate {
        replace => {
          "post_body_label.key" => "post_body"
        }
      }
      mutate {
        merge => {
          "http_token_about.labels" => "post_body_label"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "http_token_about"
      }
      on_error => "token_about_not_set"
    }

    # Check if required udm validation fields for NETWORK_HTTP exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_HTTP"
        }

      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }

  }

  # -----------------------------------------------------------------------
  # CORELIGHT_METRICS_BRO

  else if [_path] == "corelight_metrics_bro" {

    # conn
    mutate {
      convert => {
        "logs.conn.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_conn"
    }

    mutate {
      replace => {
        "token_logs_conn.value" => "%{logs.conn.entries.per-second}"
      }
      on_error => "logs_conn_not_set"
    }

    if ![logs_conn_not_set] and [logs][conn][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_conn.key" => "logs_conn_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_conn"
        }
      }
    }

    # dce_rpc
    mutate {
      convert => {
        "logs.dce_rpc.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_dce_rpc"
    }

    mutate {
      replace => {
        "token_logs_dce_rpc.value" => "%{logs.dce_rpc.entries.per-second}"
      }
      on_error => "logs_dce_rpc_not_set"
    }

    if ![logs_dce_rpc_not_set] and [logs][dce_rpc][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_dce_rpc.key" => "logs_dce_rpc_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_dce_rpc"
        }
      }
    }

    # dhcp
    mutate {
      convert => {
        "logs.dhcp.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_dhcp"
    }

    mutate {
      replace => {
        "token_logs_dhcp.value" => "%{logs.dhcp.entries.per-second}"
      }
      on_error => "logs_dhcp_not_set"
    }

    if ![logs_dhcp_not_set] and [logs][dhcp][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_dhcp.key" => "logs_dhcp_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_dhcp"
        }
      }
    }

    # dnp3
    mutate {
      convert => {
        "logs.dnp3.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_dnp3"
    }

    mutate {
      replace => {
        "token_logs_dnp3.value" => "%{logs.dnp3.entries.per-second}"
      }
      on_error => "logs_dnp3_not_set"
    }

    if ![logs_dnp3_not_set] and [logs][dnp3][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_dnp3.key" => "logs_dnp3_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_dnp3"
        }
      }
    }

    # dns
    mutate {
      convert => {
        "logs.dns.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_dns"
    }

    mutate {
      replace => {
        "token_logs_dns.value" => "%{logs.dns.entries.per-second}"
      }
      on_error => "logs_dns_not_set"
    }

    if ![logs_dns_not_set] and [logs][dns][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_dns.key" => "logs_dns_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_dns"
        }
      }
    }

    # dpd
    mutate {
      convert => {
        "logs.dpd.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_dpd"
    }

    mutate {
      replace => {
        "token_logs_dpd.value" => "%{logs.dpd.entries.per-second}"
      }
      on_error => "logs_dpd_not_set"
    }

    if ![logs_dpd_not_set] and [logs][dpd][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_dpd.key" => "logs_dpd_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_dpd"
        }
      }
    }

    # files
    mutate {
      convert => {
        "logs.files.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_files"
    }

    mutate {
      replace => {
        "token_logs_files.value" => "%{logs.files.entries.per-second}"
      }
      on_error => "logs_files_not_set"
    }

    if ![logs_files_not_set] and [logs][files][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_files.key" => "logs_files_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_files"
        }
      }
    }

    # ftp
    mutate {
      convert => {
        "logs.ftp.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_ftp"
    }

    mutate {
      replace => {
        "token_logs_ftp.value" => "%{logs.ftp.entries.per-second}"
      }
      on_error => "logs_ftp_not_set"
    }

    if ![logs_ftp_not_set] and [logs][ftp][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_ftp.key" => "logs_ftp_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_ftp"
        }
      }
    }

    # http
    mutate {
      convert => {
        "logs.http.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_http"
    }

    mutate {
      replace => {
        "token_logs_http.value" => "%{logs.http.entries.per-second}"
      }
      on_error => "logs_http_not_set"
    }

    if ![logs_http_not_set] and [logs][http][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_http.key" => "logs_http_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_http"
        }
      }
    }

    # irc
    mutate {
      convert => {
        "logs.irc.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_irc"
    }

    mutate {
      replace => {
        "token_logs_irc.value" => "%{logs.irc.entries.per-second}"
      }
      on_error => "logs_irc_not_set"
    }

    if ![logs_irc_not_set] and [logs][irc][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_irc.key" => "logs_irc_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_irc"
        }
      }
    }

    # kerberos
    mutate {
      convert => {
        "logs.kerberos.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_kerberos"
    }

    mutate {
      replace => {
        "token_logs_kerberos.value" => "%{logs.kerberos.entries.per-second}"
      }
      on_error => "logs_kerberos_not_set"
    }

    if ![logs_kerberos_not_set]
    and [logs][kerberos][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_kerberos.key" => "logs_kerberos_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_kerberos"
        }
      }
    }

    # modbus
    mutate {
      convert => {
        "logs.modbus.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_modbus"
    }

    mutate {
      replace => {
        "token_logs_modbus.value" => "%{logs.modbus.entries.per-second}"
      }
      on_error => "logs_modbus_not_set"
    }

    if ![logs_modbus_not_set] and [logs][modbus][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_modbus.key" => "logs_modbus_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_modbus"
        }
      }
    }

    # mysql
    mutate {
      convert => {
        "logs.mysql.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_mysql"
    }

    mutate {
      replace => {
        "token_logs_mysql.value" => "%{logs.mysql.entries.per-second}"
      }
      on_error => "logs_mysql_not_set"
    }

    if ![logs_mysql_not_set] and [logs][mysql][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_mysql.key" => "logs_mysql_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_mysql"
        }
      }
    }

    # ntlm
    mutate {
      convert => {
        "logs.ntlm.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_ntlm"
    }

    mutate {
      replace => {
        "token_logs_ntlm.value" => "%{logs.ntlm.entries.per-second}"
      }
      on_error => "logs_ntlm_not_set"
    }

    if ![logs_ntlm_not_set] and [logs][ntlm][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_ntlm.key" => "logs_ntlm_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_ntlm"
        }
      }
    }

    # pe
    mutate {
      convert => {
        "logs.pe.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_pe"
    }

    mutate {
      replace => {
        "token_logs_pe.value" => "%{logs.pe.entries.per-second}"
      }
      on_error => "logs_pe_not_set"
    }

    if ![logs_pe_not_set] and [logs][pe][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_pe.key" => "logs_pe_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_pe"
        }
      }
    }

    # radius
    mutate {
      convert => {
        "logs.radius.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_radius"
    }

    mutate {
      replace => {
        "token_logs_radius.value" => "%{logs.radius.entries.per-second}"
      }
      on_error => "logs_radius_not_set"
    }

    if ![logs_radius_not_set] and [logs][radius][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_radius.key" => "logs_radius_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_radius"
        }
      }
    }

    # rdp
    mutate {
      convert => {
        "logs.rdp.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_rdp"
    }

    mutate {
      replace => {
        "token_logs_rdp.value" => "%{logs.rdp.entries.per-second}"
      }
      on_error => "logs_rdp_not_set"
    }

    if ![logs_rdp_not_set] and [logs][rdp][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_rdp.key" => "logs_rdp_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_rdp"
        }
      }
    }

    # rfb
    mutate {
      convert => {
        "logs.rfb.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_rfb"
    }

    mutate {
      replace => {
        "token_logs_rfb.value" => "%{logs.rfb.entries.per-second}"
      }
      on_error => "logs_rfb_not_set"
    }

    if ![logs_rfb_not_set] and [logs][rfb][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_rfb.key" => "logs_rfb_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_rfb"
        }
      }
    }

    # sip
    mutate {
      convert => {
        "logs.sip.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_sip"
    }

    mutate {
      replace => {
        "token_logs_sip.value" => "%{logs.sip.entries.per-second}"
      }
      on_error => "logs_sip_not_set"
    }

    if ![logs_sip_not_set] and [logs][sip][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_sip.key" => "logs_sip_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_sip"
        }
      }
    }

    # smb_files
    mutate {
      convert => {
        "logs.smb_files.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_smb_files"
    }

    mutate {
      replace => {
        "token_logs_smb_files.value" => "%{logs.smb_files.entries.per-second}"
      }
      on_error => "logs_smb_files_not_set"
    }

    if ![logs_smb_files_not_set]
    and [logs][smb_files][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_smb_files.key" => "logs_smb_files_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_smb_files"
        }
      }
    }

    # smb_mapping
    mutate {
      convert => {
        "logs.smb_mapping.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_smb_mapping"
    }

    mutate {
      replace => {
        "token_logs_smb_mapping.value" =>
        "%{logs.smb_mapping.entries.per-second}"
      }
      on_error => "logs_smb_mapping_not_set"
    }

    if ![logs_smb_mapping_not_set]
    and [logs][smb_mapping][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_smb_mapping.key" => "logs_smb_mapping_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_smb_mapping"
        }
      }
    }

    # smtp
    mutate {
      convert => {
        "logs.smtp.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_smtp"
    }

    mutate {
      replace => {
        "token_logs_smtp.value" => "%{logs.smtp.entries.per-second}"
      }
      on_error => "logs_smtp_not_set"
    }

    if ![logs_smtp_not_set] and [logs][smtp][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_smtp.key" => "logs_smtp_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_smtp"
        }
      }
    }

    # snmp
    mutate {
      convert => {
        "logs.snmp.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_snmp"
    }

    mutate {
      replace => {
        "token_logs_snmp.value" => "%{logs.snmp.entries.per-second}"
      }
      on_error => "logs_snmp_not_set"
    }

    if ![logs_snmp_not_set] and [logs][snmp][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_snmp.key" => "logs_snmp_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_snmp"
        }
      }
    }

    # socks
    mutate {
      convert => {
        "logs.socks.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_socks"
    }

    mutate {
      replace => {
        "token_logs_socks.value" => "%{logs.socks.entries.per-second}"
      }
      on_error => "logs_socks_not_set"
    }

    if ![logs_socks_not_set] and [logs][socks][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_socks.key" => "logs_socks_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_socks"
        }
      }
    }

    # software
    mutate {
      convert => {
        "logs.software.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_software"
    }

    mutate {
      replace => {
        "token_logs_software.value" => "%{logs.software.entries.per-second}"
      }
      on_error => "logs_software_not_set"
    }

    if ![logs_software_not_set]
    and [logs][software][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_software.key" => "logs_software_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_software"
        }
      }
    }

    # ssh
    mutate {
      convert => {
        "logs.ssh.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_ssh"
    }

    mutate {
      replace => {
        "token_logs_ssh.value" => "%{logs.ssh.entries.per-second}"
      }
      on_error => "logs_ssh_not_set"
    }

    if ![logs_ssh_not_set] and [logs][ssh][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_ssh.key" => "logs_ssh_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_ssh"
        }
      }
    }

    # ssl
    mutate {
      convert => {
        "logs.ssl.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_ssl"
    }

    mutate {
      replace => {
        "token_logs_ssl.value" => "%{logs.ssl.entries.per-second}"
      }
      on_error => "logs_ssl_not_set"
    }

    if ![logs_ssl_not_set] and [logs][ssl][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_ssl.key" => "logs_ssl_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_ssl"
        }
      }
    }

    # syslog
    mutate {
      convert => {
        "logs.syslog.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_syslog"
    }

    mutate {
      replace => {
        "token_logs_syslog.value" => "%{logs.syslog.entries.per-second}"
      }
      on_error => "logs_syslog_not_set"
    }

    if ![logs_syslog_not_set] and [logs][syslog][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_syslog.key" => "logs_syslog_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_syslog"
        }
      }
    }

    # traceroute
    mutate {
      convert => {
        "logs.traceroute.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_traceroute"
    }

    mutate {
      replace => {
        "token_logs_traceroute.value" => "%{logs.traceroute.entries.per-second}"
      }
      on_error => "logs_traceroute_not_set"
    }

    if ![logs_traceroute_not_set]
    and [logs][traceroute][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_traceroute.key" => "logs_traceroute_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_traceroute"
        }
      }
    }

    # tunnel
    mutate {
      convert => {
        "logs.tunnel.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_tunnel"
    }

    mutate {
      replace => {
        "token_logs_tunnel.value" => "%{logs.tunnel.entries.per-second}"
      }
      on_error => "logs_tunnel_not_set"
    }

    if ![logs_tunnel_not_set] and [logs][tunnel][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_tunnel.key" => "logs_tunnel_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_tunnel"
        }
      }
    }

    # weird
    mutate {
      convert => {
        "logs.weird.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_weird"
    }

    mutate {
      replace => {
        "token_logs_weird.value" => "%{logs.weird.entries.per-second}"
      }
      on_error => "logs_weird_not_set"
    }

    if ![logs_weird_not_set] and [logs][weird][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_weird.key" => "logs_weird_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_weird"
        }
      }
    }

    # x509
    mutate {
      convert => {
        "logs.x509.entries.per-second" => "string"
      }
      on_error => "failed_to_convert_logs_x509"
    }

    mutate {
      replace => {
        "token_logs_x509.value" => "%{logs.x509.entries.per-second}"
      }
      on_error => "logs_x509_not_set"
    }

    if ![logs_x509_not_set] and [logs][x509][entries][per-second] != "" {
      mutate {
        replace => {
          "token_logs_x509.key" => "logs_x509_entries_per_second"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_x509"
        }
      }
    }

    # files_per_minute
    mutate {
      convert => {
        "files.per-minute" => "string"
      }
      on_error => "failed_to_convert_files_per_minute"
    }

    mutate {
      replace => {
        "token_files_per_minute.value" => "%{files.per-minute}"
      }
      on_error => "files_per_minute_not_set"
    }

    if ![files_per_minute_not_set] and [files][per-minute] != "" {
      mutate {
        replace => {
          "token_files_per_minute.key" => "files_per_minute"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_files_per_minute"
        }
      }
    }

    # files_queued_s3
    mutate {
      convert => {
        "files.queued.s3" => "string"
      }
      on_error => "failed_to_convert_files_queued_s3"
    }

    mutate {
      replace => {
        "token_files_queued_s3.value" => "%{files.queued.s3}"
      }
      on_error => "files_queued_s3_not_set"
    }

    if ![files_queued_s3_not_set] and [files][queued][s3] != "" {
      mutate {
        replace => {
          "token_files_queued_s3.key" => "files_queued_s3"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_files_queued_s3"
        }
      }
    }

    # files_queued_sftp
    mutate {
      convert => {
        "files.queued.sftp" => "string"
      }
      on_error => "failed_to_convert_files_queued_sftp"
    }

    mutate {
      replace => {
        "token_files_queued_sftp.value" => "%{files.queued.sftp}"
      }
      on_error => "files_queued_sftp_not_set"
    }

    if ![files_queued_sftp_not_set] and [files][queued][sftp] != "" {
      mutate {
        replace => {
          "token_files_queued_sftp.key" => "files_queued_sftp"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_files_queued_sftp"
        }
      }
    }

    # files_total
    mutate {
      convert => {
        "files.total" => "string"
      }
      on_error => "failed_to_convert_files_total"
    }

    mutate {
      replace => {
        "token_files_total.value" => "%{files.total}"
      }
      on_error => "files_total_not_set"
    }

    if ![files_total_not_set] and [files][total] != "" {
      mutate {
        replace => {
          "token_files_total.key" => "files_total"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_files_total"
        }
      }
    }

    # splunk
    mutate {
      convert => {
        "logs.splunk_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_splunk"
    }

    mutate {
      replace => {
        "token_logs_splunk.value" => "%{logs.splunk_export.lag}"
      }
      on_error => "logs_splunk_not_set"
    }

    if ![logs_splunk_not_set] and [logs][splunk_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_splunk.key" => "logs_splunk_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_splunk"
        }
      }
    }

    # syslog
    mutate {
      convert => {
        "logs.syslog_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_syslog"
    }

    mutate {
      replace => {
        "token_logs_syslog.value" => "%{logs.syslog_export.lag}"
      }
      on_error => "logs_syslog_not_set"
    }

    if ![logs_syslog_not_set] and [logs][syslog_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_syslog.key" => "logs_syslog_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_syslog"
        }
      }
    }

    # json
    mutate {
      convert => {
        "logs.json_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_json"
    }

    mutate {
      replace => {
        "token_logs_json.value" => "%{logs.json_export.lag}"
      }
      on_error => "logs_json_not_set"
    }

    if ![logs_json_not_set] and [logs][json_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_json.key" => "logs_json_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_json"
        }
      }
    }

    # kafka
    mutate {
      convert => {
        "logs.kafka_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_kafka"
    }

    mutate {
      replace => {
        "token_logs_kafka.value" => "%{logs.kafka_export.lag}"
      }
      on_error => "logs_kafka_not_set"
    }

    if ![logs_kafka_not_set] and [logs][kafka_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_kafka.key" => "logs_kafka_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_kafka"
        }
      }
    }

    # investigator
    mutate {
      convert => {
        "logs.investigator_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_investigator"
    }

    mutate {
      replace => {
        "token_logs_investigator.value" => "%{logs.investigator_export.lag}"
      }
      on_error => "logs_investigator_not_set"
    }

    if ![logs_investigator_not_set] and [logs][investigator_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_investigator.key" => "logs_investigator_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_investigator"
        }
      }
    }

    # kinesis
    mutate {
      convert => {
        "logs.kinesis_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_kinesis"
    }

    mutate {
      replace => {
        "token_logs_kinesis.value" => "%{logs.kinesis_export.lag}"
      }
      on_error => "logs_kinesis_not_set"
    }

    if ![logs_kinesis_not_set] and [logs][kinesis_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_kinesis.key" => "logs_kinesis_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_kinesis"
        }
      }
    }

    # hec
    mutate {
      convert => {
        "logs.hec_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_hec"
    }

    mutate {
      replace => {
        "token_logs_hec.value" => "%{logs.hec_export.lag}"
      }
      on_error => "logs_hec_not_set"
    }

    if ![logs_hec_not_set] and [logs][hec_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_hec.key" => "logs_hec_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_hec"
        }
      }
    }

    # elasticsearch
    mutate {
      convert => {
        "logs.elasticsearch_export.lag" => "string"
      }
      on_error => "failed_to_convert_logs_elasticsearch"
    }

    mutate {
      replace => {
        "token_logs_elasticsearch.value" => "%{logs.elasticsearch_export.lag}"
      }
      on_error => "logs_elasticsearch_not_set"
    }

    if ![logs_elasticsearch_not_set]
    and [logs][elasticsearch_export][lag] != "" {
      mutate {
        replace => {
          "token_logs_elasticsearch.key" => "logs_elasticsearch_export_lag"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_logs_elasticsearch"
        }
      }
    }

    # cpu
    mutate {
      convert => {
        "bro_cpu" => "string"
      }
      on_error => "failed_to_convert_cpu"
    }

    mutate {
      replace => {
        "token_cpu.value" => "%{bro_cpu}"
      }
      on_error => "cpu_not_set"
    }

    if ![cpu_not_set] and [bro_cpu] != "" {
      mutate {
        replace => {
          "token_cpu.key" => "cpu"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_cpu"
        }
      }
    }


    mutate {
      rename => {
        "token_about" => "bro_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "bro_about"
      }
      on_error => "failed_to_merge_bro_about"
    }


  }

  #------------------------------------------------------------------------
  # CORELIGHT_METRICS_IFACE

  else if [_path] == "corelight_metrics_iface" {

    # kpps
    mutate {
      convert => {
        "monitor.total.kpps" => "string"
      }
      on_error => "failed_to_convert_total_kpps"
    }

    mutate {
      replace => {
        "token_total_kpps.value" => "%{monitor.total.kpps}"
      }
      on_error => "total_kpps_not_set"
    }

    if ![total_kpps_not_set] and [monitor][total][kpps] != "" {
      mutate {
        replace => {
          "token_total_kpps.key" => "monitor_total_kpps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_total_kpps"
        }
      }
    }

    # drops_kpps
    mutate {
      convert => {
        "monitor.total.drops_kpps" => "string"
      }
      on_error => "failed_to_convert_total_drops_kpps"
    }

    mutate {
      replace => {
        "token_total_drops_kpps.value" => "%{monitor.total.drops_kpps}"
      }
      on_error => "total_drops_kpps_not_set"
    }

    if ![total_drops_kpps_not_set] and [monitor][total][drops_kpps] != "" {
      mutate {
        replace => {
          "token_total_drops_kpps.key" => "monitor_total_drops_kpps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_total_drops_kpps"
        }
      }
    }

    # mbps
    mutate {
      convert => {
        "monitor.total.mbps" => "string"
      }
      on_error => "failed_to_convert_total_mbps"
    }

    mutate {
      replace => {
        "token_total_mbps.value" => "%{monitor.total.mbps}"
      }
      on_error => "total_mbps_not_set"
    }

    if ![total_mbps_not_set] and [monitor][total][mbps] != "" {
      mutate {
        replace => {
          "token_total_mbps.key" => "monitor_total_mbps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_total_mbps"
        }
      }
    }

    # in_bytes_mbps
    mutate {
      convert => {
        "mgmt.in.bytes_mbps" => "string"
      }
      on_error => "failed_to_convert_in_bytes_mbps"
    }

    mutate {
      replace => {
        "token_in_bytes_mbps.value" => "%{mgmt.in.bytes_mbps}"
      }
      on_error => "in_bytes_mbps_not_set"
    }

    if ![in_bytes_mbps_not_set] and [mgmt][in][bytes_mbps] != "" {
      mutate {
        replace => {
          "token_in_bytes_mbps.key" => "mgmt_in_bytes_mbps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_in_bytes_mbps"
        }
      }
    }

    # out_bytes_mbps
    mutate {
      convert => {
        "mgmt.out.bytes_mbps" => "string"
      }
      on_error => "failed_to_convert_out_bytes_mbps"
    }

    mutate {
      replace => {
        "token_out_bytes_mbps.value" => "%{mgmt.out.bytes_mbps}"
      }
      on_error => "out_bytes_mbps_not_set"
    }

    if ![out_bytes_mbps_not_set] and [mgmt][out][bytes_mbps] != "" {
      mutate {
        replace => {
          "token_out_bytes_mbps.key" => "mgmt_out_bytes_mbps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_out_bytes_mbps"
        }
      }
    }

    # in_packets_kpps
    mutate {
      convert => {
        "mgmt.in.packets_kpps" => "string"
      }
      on_error => "failed_to_convert_in_packets_kpps"
    }

    mutate {
      replace => {
        "token_in_packets_kpps.value" => "%{mgmt.in.packets_kpps}"
      }
      on_error => "in_packets_kpps_not_set"
    }

    if ![in_packets_kpps_not_set] and [mgmt][in][packets_kpps] != "" {
      mutate {
        replace => {
          "token_in_packets_kpps.key" => "mgmt_in_packets_kpps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_in_packets_kpps"
        }
      }
    }

    # out_packets_kpps
    mutate {
      convert => {
        "mgmt.out.packets_kpps" => "string"
      }
      on_error => "failed_to_convert_out_packets_kpps"
    }

    mutate {
      replace => {
        "token_out_packets_kpps.value" => "%{mgmt.out.packets_kpps}"
      }
      on_error => "out_packets_kpps_not_set"
    }

    if ![out_packets_kpps_not_set] and [mgmt][out][packets_kpps] != "" {
      mutate {
        replace => {
          "token_out_packets_kpps.key" => "mgmt_out_packets_kpps"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_out_packets_kpps"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "iface_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "iface_about"
      }
      on_error => "failed_to_merge_iface_about"
    }

  }

  #------------------------------------------------------------------------
  # CORELIGHT_METRICS_SYSTEM

  else if [_path] == "corelight_metrics_system" {

    # cpu.1
    mutate {
      convert => {
        "cpu.1.temperature" => "string"
      }
      on_error => "failed_to_convert_cpu_1"
    }

    mutate {
      replace => {
        "token_cpu_1.value" => "%{cpu.1.temperature}"
      }
      on_error => "cpu_1_not_set"
    }

    if ![cpu_1_not_set] and [cpu][1][temperature] != "" {
      mutate {
        replace => {
          "token_cpu_1.key" => "cpu_1_temperature"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_cpu_1"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "system_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "system_about"
      }
      on_error => "failed_to_merge_system_about"
    }

  }

  #------------------------------------------------------------------------
  # CORELIGHT_METRICS_MEMORY

  else if [_path] == "corelight_metrics_memory" {

    # usage
    mutate {
      convert => {
        "usage" => "string"
      }
      on_error => "failed_to_convert_usage"
    }

    mutate {
      replace => {
        "token_usage.value" => "%{usage}"
      }
      on_error => "usage_not_set"
    }

    if ![usage_not_set] and [usage] != "" {
      mutate {
        replace => {
          "token_usage.key" => "usage"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_usage"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "memory_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "memory_about"
      }
      on_error => "failed_to_merge_memory_about"
    }
  }

  #------------------------------------------------------------------------
  # CORELIGHT_METRICS_DISK

  else if [_path] == "corelight_metrics_disk" {

    # usage_data
    mutate {
      convert => {
        "usage.data" => "string"
      }
      on_error => "failed_to_convert_usage_data"
    }

    mutate {
      replace => {
        "token_usage_data.value" => "%{usage.data}"
      }
      on_error => "usage_data_not_set"
    }

    if ![usage_data_not_set] and [usage][data] != "" {
      mutate {
        replace => {
          "token_usage_data.key" => "usage_data"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_usage_data"
        }
      }
    }

    # usage_os
    mutate {
      convert => {
        "usage.os" => "string"
      }
      on_error => "failed_to_convert_usage_os"
    }

    mutate {
      replace => {
        "token_usage_os.value" => "%{usage.os}"
      }
      on_error => "usage_os_not_set"
    }

    if ![usage_os_not_set] and [usage][os] != "" {
      mutate {
        replace => {
          "token_usage_os.key" => "usage_os"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_usage_os"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "disk_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "disk_about"
      }
      on_error => "failed_to_merge_disk_about"
    }


  }

  #------------------------------------------------------------------------
  # CORELIGHT_METRICS_ZEEK_DOCTOR

  else if [_path] == "corelight_metrics_zeek_doctor" {

    # bursty
    mutate {
      convert => {
        "check.bursty.percent" => "string"
      }
      on_error => "failed_to_convert_bursty"
    }

    mutate {
      replace => {
        "token_bursty.value" => "%{check.bursty.percent}"
      }
      on_error => "bursty_not_set"
    }

    if ![bursty_not_set] and [check][bursty][percent] != "" {
      mutate {
        replace => {
          "token_bursty.key" => "check_bursty_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_bursty"
        }
      }
    }

    # dns_half_duplex_orig
    mutate {
      convert => {
        "check.dns_half_duplex_orig.percent" => "string"
      }
      on_error => "failed_to_convert_dns_half_duplex_orig"
    }

    mutate {
      replace => {
        "token_dns_half_duplex_orig.value" =>
        "%{check.dns_half_duplex_orig.percent}"
      }
      on_error => "dns_half_duplex_orig_not_set"
    }

    if ![dns_half_duplex_orig_not_set]
    and [check][dns_half_duplex_orig][percent] != "" {
      mutate {
        replace => {
          "token_dns_half_duplex_orig.key" =>
          "check_dns_half_duplex_orig_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_dns_half_duplex_orig"
        }
      }
    }

    # dns_half_duplex_resp
    mutate {
      convert => {
        "check.dns_half_duplex_resp.percent" => "string"
      }
      on_error => "failed_to_convert_dns_half_duplex_resp"
    }

    mutate {
      replace => {
        "token_dns_half_duplex_resp.value" =>
        "%{check.dns_half_duplex_resp.percent}"
      }
      on_error => "dns_half_duplex_resp_not_set"
    }

    if ![dns_half_duplex_resp_not_set]
    and [check][dns_half_duplex_resp][percent] != "" {
      mutate {
        replace => {
          "token_dns_half_duplex_resp.key" =>
          "check_dns_half_duplex_resp_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_dns_half_duplex_resp"
        }
      }
    }

    # local_to_local
    mutate {
      convert => {
        "check.local_to_local.percent" => "string"
      }
      on_error => "failed_to_convert_local_to_local"
    }

    mutate {
      replace => {
        "token_local_to_local.value" => "%{check.local_to_local.percent}"
      }
      on_error => "local_to_local_not_set"
    }

    if ![local_to_local_not_set] and [check][local_to_local][percent] != "" {
      mutate {
        replace => {
          "token_local_to_local.key" => "check_local_to_local_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_local_to_local"
        }
      }
    }

    # remote_to_remote
    mutate {
      convert => {
        "check.remote_to_remote.percent" => "string"
      }
      on_error => "failed_to_convert_remote_to_remote"
    }

    mutate {
      replace => {
        "token_remote_to_remote.value" => "%{check.remote_to_remote.percent}"
      }
      on_error => "remote_to_remote_not_set"
    }

    if ![remote_to_remote_not_set]
    and [check][remote_to_remote][percent] != "" {
      mutate {
        replace => {
          "token_remote_to_remote.key" => "check_remote_to_remote_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_remote_to_remote"
        }
      }
    }

    # tcp_backscatter
    mutate {
      convert => {
        "check.tcp_backscatter.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_backscatter"
    }

    mutate {
      replace => {
        "token_tcp_backscatter.value" => "%{check.tcp_backscatter.percent}"
      }
      on_error => "tcp_backscatter_not_set"
    }

    if ![tcp_backscatter_not_set] and [check][tcp_backscatter][percent] != "" {
      mutate {
        replace => {
          "token_tcp_backscatter.key" => "check_tcp_backscatter_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_backscatter"
        }
      }
    }

    # tcp_byte_counts_wrong
    mutate {
      convert => {
        "check.tcp_byte_counts_wrong.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_byte_counts_wrong"
    }

    mutate {
      replace => {
        "token_tcp_byte_counts_wrong.value" =>
        "%{check.tcp_byte_counts_wrong.percent}"
      }
      on_error => "tcp_byte_counts_wrong_not_set"
    }

    if ![tcp_byte_counts_wrong_not_set]
    and [check][tcp_byte_counts_wrong][percent] != "" {
      mutate {
        replace => {
          "token_tcp_byte_counts_wrong.key" =>
          "check_tcp_byte_counts_wrong_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_byte_counts_wrong"
        }
      }
    }

    # tcp_half_duplex
    mutate {
      convert => {
        "check.tcp_half_duplex.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_half_duplex"
    }

    mutate {
      replace => {
        "token_tcp_half_duplex.value" => "%{check.tcp_half_duplex.percent}"
      }
      on_error => "tcp_half_duplex_not_set"
    }

    if ![tcp_half_duplex_not_set] and [check][tcp_half_duplex][percent] != "" {
      mutate {
        replace => {
          "token_tcp_half_duplex.key" => "check_tcp_half_duplex_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_half_duplex"
        }
      }
    }

    # tcp_missed_bytes
    mutate {
      convert => {
        "check.tcp_missed_bytes.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_missed_bytes"
    }

    mutate {
      replace => {
        "token_tcp_missed_bytes.value" => "%{check.tcp_missed_bytes.percent}"
      }
      on_error => "tcp_missed_bytes_not_set"
    }

    if ![tcp_missed_bytes_not_set]
    and [check][tcp_missed_bytes][percent] != "" {
      mutate {
        replace => {
          "token_tcp_missed_bytes.key" => "check_tcp_missed_bytes_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_missed_bytes"
        }
      }
    }

    # tcp_no_ssl_on_443
    mutate {
      convert => {
        "check.tcp_no_ssl_on_443.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_no_ssl_on_443"
    }

    mutate {
      replace => {
        "token_tcp_no_ssl_on_443.value" => "%{check.tcp_no_ssl_on_443.percent}"
      }
      on_error => "tcp_no_ssl_on_443_not_set"
    }

    if ![tcp_no_ssl_on_443_not_set]
    and [check][tcp_no_ssl_on_443][percent] != "" {
      mutate {
        replace => {
          "token_tcp_no_ssl_on_443.key" => "check_tcp_no_ssl_on_443_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_no_ssl_on_443"
        }
      }
    }

    # tcp_no_three_way_handshake
    mutate {
      convert => {
        "check.tcp_no_three_way_handshake.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_no_three_way_handshake"
    }

    mutate {
      replace => {
        "token_tcp_no_three_way_handshake.value" =>
        "%{check.tcp_no_three_way_handshake.percent}"
      }
      on_error => "tcp_no_three_way_handshake_not_set"
    }

    if ![tcp_no_three_way_handshake_not_set]
    and [check][tcp_no_three_way_handshake][percent] != "" {
      mutate {
        replace => {
          "token_tcp_no_three_way_handshake.key" =>
          "check_tcp_no_three_way_handshake_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_no_three_way_handshake"
        }
      }
    }

    # tcp_retransmissions
    mutate {
      convert => {
        "check.tcp_retransmissions.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_retransmissions"
    }

    mutate {
      replace => {
        "token_tcp_retransmissions.value" =>
        "%{check.tcp_retransmissions.percent}"
      }
      on_error => "tcp_retransmissions_not_set"
    }

    if ![tcp_retransmissions_not_set]
    and [check][tcp_retransmissions][percent] != "" {
      mutate {
        replace => {
          "token_tcp_retransmissions.key" => "check_tcp_retransmissions_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_retransmissions"
        }
      }
    }

    # tcp_scan
    mutate {
      convert => {
        "check.tcp_scan.percent" => "string"
      }
      on_error => "failed_to_convert_tcp_scan"
    }

    mutate {
      replace => {
        "token_tcp_scan.value" => "%{check.tcp_scan.percent}"
      }
      on_error => "tcp_scan_not_set"
    }

    if ![tcp_scan_not_set] and [check][tcp_scan][percent] != "" {
      mutate {
        replace => {
          "token_tcp_scan.key" => "check_tcp_scan_percent"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tcp_scan"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "zeek_doctor_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "zeek_doctor_about"
      }
      on_error => "failed_to_merge_zeek_doctor_about"
    }

  }

  # ----------------------------------------------------------------------
  # DCE_RPC
  # - https://docs.zeek.org/en/current/scripts/base/protocols/dce-rpc/main.zeek.html

  else if [_path] == "dce_rpc" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.ip_protocol" => "TCP"
      }
    }

    mutate {
      replace => {
        "token_network.application_protocol" => "DCERPC"
      }
    }

    mutate {
      convert => {
        "rtt" => "integer"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "rtt" => "token_network.session_duration.seconds"
        }
        on_error => "rtt_not_found"
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "endpoint_labels.value" => "%{endpoint}"
      }
      on_error => "endpoint_not_found"
    }
    if ![endpoint_not_found] and [endpoint] != "" {
      mutate {
        replace => {
          "endpoint_labels.key" => "endpoint"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "endpoint_labels"
        }
      }
    }

    mutate {
      replace => {
        "operation_labels.value" => "%{operation}"
      }
      on_error => "operation_not_found"
    }
    if ![operation_not_found] and [operation] != "" {
      mutate {
        replace => {
          "operation_labels.key" => "operation"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "operation_labels"
        }
      }
    }

    # UDM > Intermediary
    mutate {
      replace => {
        "dce_rpc_intermediary.resource.name" => "%{named_pipe}"
      }
      on_error => "named_pipe_not_found"
    }

    if ![named_pipe_not_found] {
      mutate {
        replace => {
          "dce_rpc_intermediary.resource.resource_type" => "PIPE"
        }
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "dce_rpc_intermediary"
      }
      on_error => "dce_rpc_intermediary_not_found"
    }

    # UDM > Metadata
    mutate {
      replace => {
        "token_metadata.description" =>
        "operation '%{operation}' on '%{endpoint}' using named pipe [%{named_pipe}]"
      }
      on_error => "description_not_set"
    }

    # UDM > About

    mutate {
      merge => {
        "dce_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "dce_token_about"
      }
      on_error => "dce_token_about_not_found"
    }

    # UDM > Security Results
    mutate {
      replace => {
        "dce_security_result.severity" => "INFORMATIONAL"
      }
    }

    mutate {
      merge => {
        "token_security_result" => "dce_security_result"
      }
    }
    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # DNS
  # - tracks and logs DNS queries along with their responses
  # - https://docs.corelight.com/docs/sensor/reference/logs/dns.html
  # - https://docs.corelight.com/docs/sensor/reference/logs/dns_red.html

  else if [_path] == "dns" or [_path] == "dns_red" {

    mutate {
      replace => {
        "question_check" => ""
      }
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "DNS"
      }
    }

    mutate {
      replace => {
        "token_network.dns_domain" => "%{icann_domain}"
      }
      on_error => "icann_domain_not_found"
    }

    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4",
      "PIM", "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    # UDM > Network > DNS
    mutate {
      convert => {
        "AA" => "boolean"
      }
      on_error => "aa_conversion_error"
    }

    mutate {
      rename => {
        "AA" => "token_network.dns.authoritative"
      }
      on_error => "aa_not_found"
    }

    mutate {
      convert => {
        "trans_id" => "uinteger"
      }
      on_error => "trans_id_conversion_error"
    }

    mutate {
      rename => {
        "trans_id" => "token_network.dns.id"
      }
      on_error => "trans_id_not_found"
    }

    mutate {
      convert => {
        "TC" => "boolean"
      }
      on_error => "tc_conversion_error"
    }

    mutate {
      rename => {
        "TC" => "token_network.dns.truncated"
      }
    }

    mutate {
      convert => {
        "RD" => "boolean"
      }
      on_error => "rd_conversion_error"
    }

    mutate {
      rename => {
        "RD" => "token_network.dns.recursion_desired"
      }
    }

    mutate {
      convert => {
        "RA" => "boolean"
      }
      on_error => "ra_conversion_error"
    }

    mutate {
      rename => {
        "RA" => "token_network.dns.recursion_available"
      }
    }

    mutate {
      convert => {
        "rejected" => "string"
      }
      on_error => "rejected_conversion_error"
    }

    mutate {
      replace => {
        "rejected_labels.value" => "%{rejected}"
      }
      on_error => "rejected_not_found"
    }
    if ![rejected_not_found] and [rejected] != "" {
      mutate {
        replace => {
          "rejected_labels.key" => "rejected"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "rejected_labels"
        }
      }
    }

    mutate {
      convert => {
        "rcode" => "string"
      }
      on_error => "rcode_conversion_error"
    }

    mutate {
      replace => {
        "check_rcode" => "%{rcode}"
      }
      on_error => "rcode_not_found"
    }

    if ![rcode_not_found] and [rcode] != "" {
      mutate {
        replace => {
          "token_network.dns.response" => "true"
        }
      }
      mutate {
        convert => {
          "token_network.dns.response" => "boolean"
        }
        on_error => "network_dns_response_not_found"
      }
    }

    mutate {
      convert => {
        "rcode" => "uinteger"
      }
      on_error => "rcode_conversion_error"
    }

    mutate {
      rename => {
        "rcode" => "token_network.dns.response_code"
      }
    }

    mutate {
      convert => {
        "rtt" => "integer"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "rtt" => "token_network.session_duration.seconds"
        }
        on_error => "rtt_not_found"
      }
    }

    # UDM > Network > DNS > Answers
    for index_ans,ans in answers {
      for index_ttl, ttl in TTLs {
        if [index_ans] == [index_ttl] {
          mutate {
            replace => {
              "token_answer" => ""
            }
          }
          mutate {
            replace => {
              "token_answer.name" => "%{ans}"
            }
          }
          mutate {
            convert => {
              "ttl" => "uinteger"
            }
            on_error => "ttl_conversion_error"
          }
          if ![ttl_conversion_error] {
            mutate {
              rename => {
                "ttl" => "token_answer.ttl"
              }
            }
          }
          mutate {
            merge => {
              "token_network.dns.answers" => "token_answer"
            }
          }
        }
      }
    }

    # UDM > Network > DNS > Question
    mutate {
      convert => {
        "qclass" => "string"
      }
      on_error => "qclass_conversion_error"
    }
    mutate {
      replace => {
        "question_check" => "%{qclass}"
      }
      on_error => "qclass_not_found"
    }
    mutate {
      replace => {
        "token_questions.class" => "%{qclass}"
      }
      on_error => "qclass_not_found"
    }
    mutate {
      convert => {
        "token_questions.class" => "uinteger"
      }
      on_error => "qclass_conversion_error"
    }

    mutate {
      replace => {
        "is_question_name_exist" => "false"
      }
    }

    mutate {
      replace => {
        "question_check" => "%{query}"
      }
      on_error => "query_not_found"
    }

    if ![query_not_found] and [query] != "" and [query] =~ "^(.){1,255}$" {
      mutate {
        replace => {
          "is_question_name_exist" => "true"
        }
      }

      mutate {
        replace => {
          "token_questions.name" => "%{query}"
        }
      }
    }

    mutate {
      convert => {
        "qtype" => "string"
      }
      on_error => "qtype_conversion_error"
    }
    mutate {
      replace => {
        "question_check" => "%{qtype}"
      }
      on_error => "qtype_not_found"
    }
    mutate {
      replace => {
        "token_questions.type" => "%{qtype}"
      }
      on_error => "qtype_not_found"
    }
    mutate {
      convert => {
        "token_questions.type" => "uinteger"
      }
      on_error => "qtype_conversion_error"
    }
    mutate {
      merge => {
        "token_network.dns.questions" => "token_questions"
      }
      on_error => "token_questions_not_found"
    }

    # UDM > Security Results
    mutate {
      convert => {
        "num" => "string"
      }
      on_error => "num_conversion_error"
    }

    mutate {
      replace => {
        "num_labels.value" => "%{num}"
      }
      on_error => "num_not_found"
    }
    if ![num_not_found] and [num] != "" {
      mutate {
        replace => {
          "num_labels.key" => "num"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "num_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "dns_security_result"
      }
      on_error => "dns_security_result_not_found"
    }

    # UDM > About
    mutate {
      replace => {
        "icann_host_subdomain_labels.value" => "%{icann_host_subdomain}"
      }
      on_error => "icann_host_subdomain_not_found"
    }
    if ![icann_host_subdomain_not_found] and [icann_host_subdomain] != "" {
      mutate {
        replace => {
          "icann_host_subdomain_labels.key" => "icann_host_subdomain"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "icann_host_subdomain_labels"
        }

      }
    }

    mutate {
      replace => {
        "icann_tld_labels.value" => "%{icann_tld}"
      }
      on_error => "icann_tld_not_found"
    }
    if ![icann_tld_not_found] and [icann_tld] != "" {
      mutate {
        replace => {
          "icann_tld_labels.key" => "icann_tld"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "icann_tld_labels"
        }
      }
    }

    mutate {
      replace => {
        "is_trusted_domain_labels.value" => "%{is_trusted_domain}"
      }
      on_error => "is_trusted_domain_not_found"
    }
    if ![is_trusted_domain_not_found] and [is_trusted_domain] != "" {
      mutate {
        replace => {
          "is_trusted_domain_labels.key" => "is_trusted_domain"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "is_trusted_domain_labels"
        }
      }
    }

    mutate {
      replace => {
        "qclass_name_labels.value" => "%{qclass_name}"
      }
      on_error => "qclass_name_not_found"
    }
    if ![qclass_name_not_found] and [qclass_name] != "" {
      mutate {
        replace => {
          "qclass_name_labels.key" => "qclass_name"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "qclass_name_labels"
        }
      }
    }

    mutate {
      replace => {
        "qtype_name_labels.value" => "%{qtype_name}"
      }
      on_error => "qtype_name_not_found"
    }
    if ![qtype_name_not_found] and [qtype_name] != "" {
      mutate {
        replace => {
          "qtype_name_labels.key" => "qtype_name"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "qtype_name_labels"
        }
      }
    }

    mutate {
      replace => {
        "rcode_name_labels.value" => "%{rcode_name}"
      }
      on_error => "rcode_name_not_found"
    }
    if ![rcode_name_not_found] and [rcode_name] != "" {
      mutate {
        replace => {
          "rcode_name_labels.key" => "rcode_name"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "rcode_name_labels"
        }
      }
    }

    mutate {
      convert => {
        "Z" => "string"
      }
      on_error => "z_not_found"
    }
    mutate {
      replace => {
        "z_labels.value" => "%{Z}"
      }
      on_error => "z_not_found"
    }
    if ![z_not_found] and [Z] != "" {
      mutate {
        replace => {
          "z_labels.key" => "Z"
        }
      }
      mutate {
        merge => {
          "dns_about.labels" => "z_labels"
        }
      }
    }

    mutate {
      merge => {
        "dns_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "dns_about"
      }
      on_error => "dns_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_DNS exist, if not set as NETWORK_UNCATEGORIZED.
    # Occasional DNS logs include no question, we drop them as they have no pratical usage
    # UDM > Metadata > Event Type
    if [principal_present] == "true" and [question_check] != ""
    and [is_question_name_exist] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DNS"
        }
      }
    }
    else if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SIP
  # - Implements base functionality for SIP analysis. The logging model is to log request/response pairs and all relevant metadata together in a single record.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/sip/main.zeek.html

  else if [_path] == "sip" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "SIP"
      }
    }

    mutate {
      convert => {
        "response_body_len" => "uinteger"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "response_body_len" => "token_network.received_bytes"
        }
        on_error => "response_body_len_not_found"
      }
    }

    mutate {
      convert => {
        "request_body_len" => "uinteger"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "request_body_len" => "token_network.sent_bytes"
        }
        on_error => "request_body_len_not_found"
      }
    }

    mutate {
      replace => {
        "token_network.session_id" => "%{call_id}"
      }
      on_error => "call_id_not_found"
    }

    # UDM > Principal
    mutate {
      replace => {
        "request_from_labels.value" => "%{request_from}"
      }
      on_error => "request_from_not_found"
    }
    if ![request_from_not_found] and [request_from] != "" {
      mutate {
        replace => {
          "request_from_labels.key" => "request_from"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "request_from_labels"
        }
      }
    }

    mutate {
      replace => {
        "response_from_labels.value" => "%{response_from}"
      }
      on_error => "response_from_not_found"
    }
    if ![response_from_not_found] and [response_from] != "" {
      mutate {
        replace => {
          "response_from_labels.key" => "response_from"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "response_from_labels"
        }
      }
    }

    # UDM > Security Result
    mutate {
      replace => {
        "sip_security_result.description" => "%{status_msg}"
      }
      on_error => "status_msg_not_found"
    }

    mutate {
      replace => {
        "sip_security_result.summary" => "%{warning}"
      }
      on_error => "warning_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "sip_security_result"
      }
      on_error => "sip_security_result_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "request_to_labels.value" => "%{request_to}"
      }
      on_error => "request_to_not_found"
    }
    if ![request_to_not_found] and [request_to] != "" {
      mutate {
        replace => {
          "request_to_labels.key" => "request_to"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "request_to_labels"
        }
      }
    }

    mutate {
      replace => {
        "response_to_labels.value" => "%{response_to}"
      }
      on_error => "response_to_not_found"
    }
    if ![response_to_not_found] and [response_to] != "" {
      mutate {
        replace => {
          "response_to_labels.key" => "response_to"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "response_to_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_target.url" => "%{uri}"
      }
      on_error => "uri_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "token_sip.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "content_type_labels.value" => "%{content_type}"
      }
      on_error => "content_type_not_found"
    }
    if ![content_type_not_found] and [content_type] != "" {
      mutate {
        replace => {
          "content_type_labels.key" => "content_type"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "content_type_labels"
        }
      }
    }

    mutate {
      replace => {
        "date_labels.value" => "%{date}"
      }
      on_error => "date_not_found"
    }
    if ![date_not_found] and [date] != "" {
      mutate {
        replace => {
          "date_labels.key" => "date"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "date_labels"
        }
      }
    }

    mutate {
      replace => {
        "method_labels.value" => "%{method}"
      }
      on_error => "method_not_found"
    }
    if ![method_not_found] and [method] != "" {
      mutate {
        replace => {
          "method_labels.key" => "method"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "method_labels"
        }
      }
    }

    mutate {
      replace => {
        "reply_to_labels.value" => "%{reply_to}"
      }
      on_error => "reply_to_not_found"
    }
    if ![reply_to_not_found] and [reply_to] != "" {
      mutate {
        replace => {
          "reply_to_labels.key" => "reply_to"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "reply_to_labels"
        }
      }
    }

    for reqpath in request_path {
      mutate {
        replace => {
          "req_path_labels" => ""
        }
      }
      mutate {
        replace => {
          "req_path_labels.value" => "%{reqpath}"
        }
        on_error => "req_path_not_found"
      }
      if ![req_path_not_found] and [reqpath] != "" {
        mutate {
          replace => {
            "req_path_labels.key" => "request_path"
          }
        }
        mutate {
          merge => {
            "token_sip.labels" => "req_path_labels"
          }
        }
      }
    }

    for respath in response_path {
      mutate {
        replace => {
          "res_path_labels" => ""
        }
      }
      mutate {
        replace => {
          "res_path_labels.value" => "%{respath}"
        }
        on_error => "res_path_not_found"
      }
      if ![res_path_not_found] and [respath] != "" {
        mutate {
          replace => {
            "res_path_labels.key" => "response_path"
          }
        }
        mutate {
          merge => {
            "token_sip.labels" => "res_path_labels"
          }
        }
      }
    }

    mutate {
      replace => {
        "seq_labels.value" => "%{seq}"
      }
      on_error => "seq_not_found"
    }
    if ![seq_not_found] and [seq] != "" {
      mutate {
        replace => {
          "seq_labels.key" => "seq"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "seq_labels"
        }
      }
    }

    mutate {
      convert => {
        "status_code" => "string"
      }
      on_error => "status_code_conversion_error"
    }
    mutate {
      replace => {
        "status_code_labels.value" => "%{status_code}"
      }
      on_error => "status_code_not_found"
    }
    if ![status_code_not_found] and [status_code] != "" {
      mutate {
        replace => {
          "status_code_labels.key" => "status_code"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "status_code_labels"
        }
      }
    }

    mutate {
      replace => {
        "subject_labels.value" => "%{subject}"
      }
      on_error => "subject_not_found"
    }
    if ![subject_not_found] and [subject] != "" {
      mutate {
        replace => {
          "subject_labels.key" => "subject"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "subject_labels"
        }
      }
    }

    mutate {
      convert => {
        "trans_depth" => "string"
      }
      on_error => "trans_depth_conversion_error"
    }
    mutate {
      replace => {
        "trans_depth_labels.value" => "%{trans_depth}"
      }
      on_error => "trans_depth_not_found"
    }
    if ![trans_depth_not_found] and [trans_depth] != "" {
      mutate {
        replace => {
          "trans_depth_labels.key" => "trans_depth"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "trans_depth_labels"
        }
      }
    }

    mutate {
      replace => {
        "user_agent_labels.value" => "%{user_agent}"
      }
      on_error => "user_agent_not_found"
    }
    if ![user_agent_not_found] and [user_agent] != "" {
      mutate {
        replace => {
          "user_agent_labels.key" => "user_agent"
        }
      }
      mutate {
        merge => {
          "token_sip.labels" => "user_agent_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "token_sip"
      }
      on_error => "token_sip_not_found"
    }

    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SSL
  # - https://docs.zeek.org/en/current/scripts/base/protocols/ssl/

  else if [_path] in ["ssl", "ssl_red"] {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "HTTPS"
      }
    }

    mutate {
      replace => {
        "token_network.ip_protocol" => "TCP"
      }
    }

    mutate {
      replace => {
        "token_network.tls.next_protocol" => "%{next_protocol}"
      }
      on_error => "next_protocol_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.version" => "%{version}"
      }
      on_error => "version_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.cipher" => "%{cipher}"
      }
      on_error => "cipher_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.client.server_name" => "%{server_name}"
      }
      on_error => "server_name_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.curve" => "%{curve}"
      }
      on_error => "curve_not_found"
    }

    mutate {
      replace => {
        "checkja3" => "%{ja3}"
      }
      on_error => "ja3_check"
    }
    if ![ja3_check] and [ja3] =~ /^[0-9a-f]+$/ {
      mutate {
        replace => {
          "token_network.tls.client.ja3" => "%{ja3}"
        }
        on_error => "ja3_not_found"
      }
    }

    mutate {
      replace => {
        "checkja3s" => "%{ja3s}"
      }
      on_error => "ja3s_check"
    }
    if ![ja3s_check] and [ja3s] =~ /^[0-9a-f]+$/ {
      mutate {
        replace => {
          "token_network.tls.server.ja3s" => "%{ja3s}"
        }
        on_error => "ja3s_not_found"
      }
    }

    mutate {
      convert => {
        "resumed" => "boolean"
      }
      on_error => "resumed_conversion_error"
    }
    mutate {
      rename => {
        "resumed" => "token_network.tls.resumed"
      }
    }

    mutate {
      convert => {
        "established" => "boolean"
      }
      on_error => "established_conversion_error"
    }
    mutate {
      rename => {
        "established" => "token_network.tls.established"
      }
    }

    # UDM > Principal
    for index,client_cert_chain_fp in client_cert_chain_fps {
      mutate {
        replace => {
          "var_client_cert_chain_fps.value" => "%{client_cert_chain_fp}"
        }
        on_error => "client_cert_chain_fps_not_found"
      }
      if ![client_cert_chain_fps_not_found] and [client_cert_chain_fp] != "" {
        mutate {
          replace => {
            "var_client_cert_chain_fps.key" => "client_cert_chain_fps"
          }
        }
        mutate {
          merge => {
            "token_principal.labels" => "var_client_cert_chain_fps"
          }
        }
      }
      mutate {
        replace => {
          "var_client_cert_chain_fps" => ""
        }
      }
    }

    # UDM > Target
    for index,cert_chain_fp in cert_chain_fps {
      mutate {
        replace => {
          "var_cert_chain_fps.value" => "%{cert_chain_fp}"
        }
        on_error => "cert_chain_fps_not_found"
      }
      if ![cert_chain_fps_not_found] and [cert_chain_fp] != "" {
        mutate {
          replace => {
            "var_cert_chain_fps.key" => "cert_chain_fps"
          }
        }
        mutate {
          merge => {
            "token_target.labels" => "var_cert_chain_fps"
          }
        }
      }
      mutate {
        replace => {
          "var_cert_chain_fps" => ""
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "var_ssl_history.value" => "%{ssl_history}"
      }
      on_error => "ssl_history_not_found"
    }
    if ![ssl_history_not_found] and [ssl_history] != "" {
      mutate {
        replace => {
          "var_ssl_history.key" => "ssl_history"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_ssl_history"
        }
      }
    }

    mutate {
      convert => {
        "sni_matches_cert" => "string"
      }
      on_error => "sni_matches_cert_failed"
    }
    mutate {
      replace => {
        "var_sni_matches_cert.value" => "%{sni_matches_cert}"
      }
      on_error => "sni_matches_cert_not_found"
    }
    if ![sni_matches_cert_not_found] and [sni_matches_cert] != "" {
      mutate {
        replace => {
          "var_sni_matches_cert.key" => "sni_matches_cert"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_sni_matches_cert"
        }
      }
    }

    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }

    # UDM > Security Results
    mutate {
      replace => {
        "var_security_result.severity" => "INFORMATIONAL"
      }
    }

    mutate {
      replace => {
        "sr_action_allow" => "ALLOW"
      }
    }

    mutate {
      merge => {
        "var_security_result.action" => "sr_action_allow"
      }
    }

    mutate {
      replace => {
        "var_security_result.description" => "%{last_alert}"
      }
      on_error => "last_alert_not_found"
    }

    mutate {
      replace => {
        "var_validation_status.value" => "%{validation_status}"
      }
      on_error => "validation_status_not_found"
    }
    if ![validation_status_not_found] and [validation_status] != "" {
      mutate {
        replace => {
          "var_validation_status.key" => "validation_status"
        }
      }
      mutate {
        merge => {
          "var_security_result.detection_fields" => "var_validation_status"
        }
      }
    }
    mutate {
      merge => {
        "token_security_result" => "var_security_result"
      }
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SMB_FILES
  # - https://docs.zeek.org/en/current/scripts/base/protocols/smb/main.zeek.html

  else if [_path] == "smb_files" {

    # UDM > Metadata
    mutate {
      replace => {
        "token_metadata.description" => "action: %{action} on: %{name}"
      }
      on_error => "description_not_set"
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.ip_protocol" => "TCP"
      }
    }

    mutate {
      replace => {
        "token_network.application_protocol" => "SMB"
      }
    }

    # UDM > About
    mutate {
      replace => {
        "var_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }
    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "var_fuid.key" => "fuid"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_fuid"
        }
      }
    }

    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }
    # UDM > Principal
    mutate {
      replace => {
        "principal_hostname_present" => "false"
      }
    }

    # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
    # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled

    mutate {
      replace => {
        "token_principal.hostname" => "%{id.orig_h}"
      }
      on_error => "id_orig_h_not_found"
    }
    if ![id_orig_h_not_found] {
      mutate {
        replace => {
          "principal_hostname_present" => "true"
        }
      }
    }

    # UDM > Target
    mutate {
      convert => {
        "size" => "uinteger"
      }
      on_error => "not_size"
    }

    if ![not_size] {
      mutate {
        rename => {
          "size" => "token_target.file.size"
        }
      }
    }

    date {
      match => ["times.modified", "RFC3339"]
      rebase => true
      target => "token_target.file.last_modification_time"
      on_error => "times_modified_not_found"
    }
    date {
      match => ["times.accessed", "RFC3339"]
      rebase => true
      target => "token_target.file.last_seen_time"
      on_error => "times_accessed_not_found"
    }
    date {
      match => ["times.created", "RFC3339"]
      rebase => true
      target => "token_target.file.first_seen_time"
      on_error => "times_created_not_found"
    }

    mutate {
      replace => {
        "var_action.value" => "%{action}"
      }
      on_error => "action_not_set"
    }
    if ![action_not_set] and [action] != "" {
      mutate {
        replace => {
          "var_action.key" => "action"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_action"
        }
      }
    }

    mutate {
      replace => {
        "var_times_changed.value" => "%{times.changed}"
      }
      on_error => "times_changed_not_set"
    }
    if ![times_changed_not_set] and [times][changed] != "" {
      mutate {
        replace => {
          "var_times_changed.key" => "times_changed"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_times_changed"
        }
      }
    }
    mutate {
      convert => {
        "data_len_rsp" => "string"
      }
      on_error => "data_len_rsp_convert_failure"
    }
    mutate {
      convert => {
        "data_len_req" => "string"
      }
      on_error => "data_len_req_convert_failure"
    }
    mutate {
      convert => {
        "data_offset_req" => "string"
      }
      on_error => "data_offset_req_convert_failure"
    }
    mutate {
      replace => {
        "var_data_offset_req.value" => "%{data_offset_req}"
      }
      on_error => "data_offset_req_not_set"
    }
    if ![data_offset_req_not_set] and [data_offset_req] != "" {
      mutate {
        replace => {
          "var_data_offset_req.key" => "data_offset_req"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_data_offset_req"
        }
      }
    }

    mutate {
      replace => {
        "var_data_len_req.value" => "%{data_len_req}"
      }
      on_error => "data_len_req_not_set"
    }
    if ![data_len_req_not_set] and [data_len_req] != "" {
      mutate {
        replace => {
          "var_data_len_req.key" => "data_len_req"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_data_len_req"
        }
      }
    }

    mutate {
      replace => {
        "var_data_len_rsp.value" => "%{data_len_rsp}"
      }
      on_error => "data_len_rsp_not_set"
    }
    if ![data_len_rsp_not_set] and [data_len_rsp] != "" {
      mutate {
        replace => {
          "var_data_len_rsp.key" => "data_len_rsp"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_data_len_rsp"
        }
      }
    }

    mutate {
      replace => {
        "token_target.file.full_path" => "%{path}"
      }
      on_error => "path_not_set"
    }

    mutate {
      merge => {
        "token_target.file.names" => "name"
      }
      on_error => "name_not_found"
    }

    mutate {
      replace => {
        "target_file_present" => "false"
      }
    }
    if ![times_modified_not_found] or ![times_accessed_not_found] or ![times_created_not_found] or ![path_not_set] or ![name_not_found] {
      mutate {
        replace => {
          "target_file_present" => "true"
        }
      }
    }

    # UDM > Source
    mutate {
      replace => {
        "src_file_present" => "false"
      }
    }
    mutate {
      merge => {
        "token_src.file.names" => "prev_name"
      }
      on_error => "prev_name_not_set"
    }
    if ![prev_name_not_set] and [prev_name] != "" {
      mutate {
        replace => {
          "src_file_present" => "true"
        }
      }
    }

    # UDM > Security Results
    mutate {
      replace => {
        "var_token_security_result.severity" => "INFORMATIONAL"
      }
    }
    mutate {
      replace => {
        "sr_action_allow" => "ALLOW"
      }
    }
    mutate {
      merge => {
        "var_token_security_result.action" => "sr_action_allow"
      }
    }
    mutate {
      merge => {
        "token_security_result" => "var_token_security_result"
      }
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" and
    [principal_hostname_present] == "true" and [target_file_present] == "true" {
      if ![action_not_set] {
        if [action] == "SMB::FILE_READ" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_READ"
            }
          }
        }
        else if [action] == "SMB::FILE_WRITE" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_MODIFICATION"
            }
          }
        }
        else if [action] == "SMB::FILE_OPEN" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_OPEN"
            }
          }
        }
        else if [action] == "SMB::FILE_CLOSE" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_UNCATEGORIZED"
            }
          }
        }
        else if [action] == "SMB::FILE_DELETE" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_DELETION"
            }
          }
        }
        else if [action] == "SMB::FILE_RENAME"
        and [src_file_present] == "true" {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_MOVE"
            }
          }
        }
        else {
          mutate {
            replace => {
              "token_metadata.event_type" => "FILE_UNCATEGORIZED"
            }
          }
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SMB_MAPPING
  # - https://docs.zeek.org/en/current/scripts/base/protocols/smb/main.zeek.html

  else if [_path] == "smb_mapping" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.ip_protocol" => "TCP"
      }
    }

    mutate {
      replace => {
        "token_network.application_protocol" => "SMB"
      }
    }

    # UDM > About
    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }

    # UDM > Target
    mutate {
      replace => {
        "var_share_type" => "%{share_type}"
      }
      on_error => "share_type_not_found"
    }
    if ![share_type_not_found] {
      if [var_share_type] == "DISK" {
        mutate {
          replace => {
            "token_target.resource.resource_type" => "STORAGE_OBJECT"
          }
        }
      }
      else if [var_share_type] == "PIPE" {
        mutate {
          replace => {
            "token_target.resource.resource_type" => "PIPE"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_target.resource.resource_type" => "UNSPECIFIED"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_target.resource.resource_subtype" => "%{share_type}"
      }
      on_error => "share_type_not_set"
    }

    mutate {
      replace => {
        "token_target.application" => "%{service}"
      }
      on_error => "service_not_set"
    }

    mutate {
      replace => {
        "var_path.value" => "%{path}"
      }
      on_error => "path_not_set"
    }
    if ![path_not_set] and [path] != "" {
      mutate {
        replace => {
          "var_path.key" => "path"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "var_path"
        }
      }
    }

    mutate {
      replace => {
        "var_native_file_system.value" => "%{native_file_system}"
      }
      on_error => "native_file_system_not_set"
    }
    if ![native_file_system_not_set] and [native_file_system] != "" {
      mutate {
        replace => {
          "var_native_file_system.key" => "native_file_system"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "var_native_file_system"
        }
      }
    }

    # UDM > Security Results
    mutate {
      replace => {
        "var_token_security_result.severity" => "INFORMATIONAL"
      }
    }
    mutate {
      replace => {
        "sr_action_allow" => "ALLOW"
      }
    }
    mutate {
      merge => {
        "var_token_security_result.action" => "sr_action_allow"
      }
    }
    mutate {
      merge => {
        "token_security_result" => "var_token_security_result"
      }
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SMTP
  # - SMTP transaction.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/smtp/main.zeek.html

  else if [_path] == "smtp" {

    # UDM > Principal
    mutate {
      merge => {
        "token_principal.ip" => "x_originating_ip"
      }
      on_error => "x_originating_ip_not_found"
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.domain.name" => "%{helo}"
      }
      on_error => "helo_not_found"
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "SMTP"
      }
    }

    grok {
      match => {
        "mailfrom" => [
        ".*?\\s+<?(?P<smtp_mail_from>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
        "<?(?P<smtp_mail_from>.*@.*\\.[a-zA-Z0-9]+)>?$"
        ]
      }
      on_error => "mailfrom_not_found"
    }
    mutate {
      rename => {
        "smtp_mail_from" => "token_network.smtp.mail_from"
      }
    }
    grok {
      match => {
        "from" => [
        ".*?\\s+<?(?P<email_from>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
        "<?(?P<email_from>.*@.*\\.[a-zA-Z0-9]+)>?$"
        ]
      }
      on_error => "_from_field_not_set"
    }
    mutate {
      rename => {
        "email_from" => "token_network.email.from"
      }
    }

    for index,var_rcptto in rcptto {
      grok {
        match => {
          "var_rcptto" => [
          ".*?\\s+<?(?P<smtp_rcpt_to>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
          "<?(?P<smtp_rcpt_to>.*@.*\\.[a-zA-Z0-9]+)>?$"
          ]
        }
        overwrite => ["smtp_rcpt_to"]
        on_error => "rcptto_not_found"
      }
      if ![rcptto_not_found] {
        mutate {
          merge => {
            "token_network.smtp.rcpt_to" => "smtp_rcpt_to"
          }
        }
      }
    }

    for index,var_to in to {
      grok {
        match => {
          "var_to" => [
          ".*?\\s+<?(?P<email_to>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
          "<?(?P<email_to>.*@.*\\.[a-zA-Z0-9]+)>?$"
          ]
        }
        overwrite => ["email_to"]
        on_error => "to_not_found"
      }
      if ![to_not_found] {
        mutate {
          merge => {
            "token_network.email.to" => "email_to"
          }
        }
      }
    }

    for index,var_cc in cc {
      grok {
        match => {
          "var_cc" => [
          ".*?\\s+<?(?P<email_cc>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
          "<?(?P<email_cc>.*@.*\\.[a-zA-Z0-9]+)>?$"
          ]
        }
        overwrite => ["email_cc"]
        on_error => "cc_not_found"
      }
      if ![cc_not_found] {
        mutate {
          merge => {
            "token_network.email.cc" => "email_cc"
          }
        }
      }
    }

    mutate {
      merge => {
        "token_network.email.subject" => "subject"
      }
      on_error => "subject_not_found"
    }

    grok {
      match => {
        "reply_to" => [
        ".*?\\s+<?(?P<email_reply_to>[^\\s]*@.*\\.[a-zA-Z0-9]+)>?$"
        "<?(?P<email_reply_to>.*@.*\\.[a-zA-Z0-9]+)>?$"
        ]
      }
      on_error => "reply_to_not_found"
    }
    mutate {
      rename => {
        "email_reply_to" => "token_network.email.reply_to"
      }
    }

    mutate {
      replace => {
        "token_network.email.mail_id" => "%{msg_id}"
      }
      on_error => "msg_id_not_found"
    }

    mutate {
      merge => {
        "token_network.smtp.server_response" => "last_reply"
      }
      on_error => "last_reply_not_found"
    }

    mutate {
      convert => {
        "tls" => "boolean"
      }
      on_error => "tls_conversion_error"
    }
    mutate {
      rename => {
        "tls" => "token_network.smtp.is_tls"
      }
    }

    mutate {
      convert => {
        "is_webmail" => "boolean"
      }
      on_error => "is_webmail_conversion_error"
    }
    mutate {
      rename => {
        "is_webmail" => "token_network.smtp.is_webmail"
      }
    }

    # UDM > About
    for index,var_fuids in fuids {
      mutate {
        replace => {
          "var_fuids_kv.value" => "%{var_fuids}"
        }
        on_error => "fuids_not_found"
      }
      if ![fuids_not_found] and [var_fuids] != "" {
        mutate {
          replace => {
            "var_fuids_kv.key" => "fuid"
          }
        }
        mutate {
          merge => {
            "var_token_about.labels" => "var_fuids_kv"
          }
        }
      }
      mutate {
        replace => {
          "var_fuids_kv" => ""
        }
      }
    }

    for index,var_urls in urls {
      mutate {
        replace => {
          "var_about" => ""
        }
      }
      mutate {
        replace => {
          "var_about.url" => "%{var_urls}"
        }
        on_error => "urls_not_found"
      }
      mutate {
        merge => {
          "token_about" => "var_about"
        }
        on_error => "var_about_not_found"
      }
    }

    for index,var_domains in domains {
      mutate {
        replace => {
          "domain_about" => ""
        }
      }
      mutate {
        replace => {
          "domain_about.domain.name" => "%{var_domains}"
        }
        on_error => "domains_not_found"
      }
      mutate {
        merge => {
          "token_about" => "domain_about"
        }
        on_error => "domain_about_not_found"
      }
    }

    mutate {
      convert => {
        "trans_depth" => "string"
      }
      on_error => "trans_depth_conversion_filed"
    }
    mutate {
      replace => {
        "var_trans_depth.value" => "%{trans_depth}"
      }
      on_error => "trans_depth_not_found"
    }
    if ![trans_depth_not_found] and [trans_depth] != "" {
      mutate {
        replace => {
          "var_trans_depth.key" => "trans_depth"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_trans_depth"
        }
      }
    }

    mutate {
      replace => {
        "var_date.value" => "%{date}"
      }
      on_error => "date_not_found"
    }
    if ![date_not_found] and [date] != "" {
      mutate {
        replace => {
          "var_date.key" => "date"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_date"
        }
      }
    }

    mutate {
      replace => {
        "var_in_reply_to.value" => "%{in_reply_to}"
      }
      on_error => "in_reply_to_not_found"
    }
    if ![in_reply_to_not_found] and [in_reply_to] != "" {
      mutate {
        replace => {
          "var_in_reply_to.key" => "in_reply_to"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_in_reply_to"
        }
      }
    }

    mutate {
      replace => {
        "var_first_received.value" => "%{first_received}"
      }
      on_error => "first_received_not_found"
    }
    if ![first_received_not_found] and [first_received] != "" {
      mutate {
        replace => {
          "var_first_received.key" => "first_received"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_first_received"
        }
      }
    }

    mutate {
      replace => {
        "var_second_received.value" => "%{second_received}"
      }
      on_error => "second_received_not_found"
    }
    if ![second_received_not_found] and [second_received] != "" {
      mutate {
        replace => {
          "var_second_received.key" => "second_received"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_second_received"
        }
      }
    }

    mutate {
      replace => {
        "var_user_agent.value" => "%{user_agent}"
      }
      on_error => "user_agent_not_found"
    }
    if ![user_agent_not_found] and [user_agent] != "" {
      mutate {
        replace => {
          "var_user_agent.key" => "user_agent"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_user_agent"
        }
      }
    }

    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }

    # UDM > Intermediary
    for index,var_path in path {
      mutate {
        merge => {
          "var_token_intermediary.ip" => "var_path"
        }
        on_error => "path_not_found"
      }
    }
    mutate {
      merge => {
        "token_intermediary" => "var_token_intermediary"
      }
      on_error => "var_token_intermediary_not_found"
    }

    # Check if required udm validation fields for NETWORK_SMTP exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_SMTP"
        }

      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SMTP Links
  # - https://docs.zeek.org/en/current/scripts/base/protocols/smtp/main.zeek.html

  else if [_path] == "smtp_links" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "SMTP"
      }
    }

    # UDM > About
    mutate {
      replace => {
        "var_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }
    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "var_fuid.key" => "fuid"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_fuid"
        }
      }
    }

    mutate {
      replace => {
        "var_token_about.url" => "%{link}"
      }
      on_error => "link_not_found"
    }

    mutate {
      replace => {
        "var_token_about.domain.name" => "%{domain}"
      }
      on_error => "domain_not_found"
    }

    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_SMTP exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_SMTP"
        }

      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SSH
  # - Implements base functionality for SSH analysis. Generates the ssh.log file.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/ssh/main.zeek.html

  else if [_path] == "ssh" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "SSH"
      }
    }
    mutate {
      convert => {
        "version" => "string"
      }
      on_error => "version_convert_failure"
    }
    mutate {
      replace => {
        "token_network.application_protocol_version" => "SSH %{version}"
      }
      on_error => "version_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.cipher" => "%{cipher_alg}"
      }
      on_error => "cipher_alg_not_found"
    }

    mutate {
      replace => {
        "var_direction" => "%{direction}"
      }
      on_error => "direction_not_found"
    }
    if ![direction_not_found] {
      if [var_direction] == "INBOUND" {
        mutate {
          replace => {
            "token_network.direction" => "INBOUND"
          }
        }
      }
      else if [var_direction] == "OUTBOUND" {
        mutate {
          replace => {
            "token_network.direction" => "OUTBOUND"
          }
        }
      }
    }

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.application" => "%{client}"
      }
      on_error => "client_not_found"
    }

    mutate {
      replace => {
        "var_hassh.value" => "%{hassh}"
      }
      on_error => "hassh_not_found"
    }
    if ![hassh_not_found] and [hassh] != "" {
      mutate {
        replace => {
          "var_hassh.key" => "hassh"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_hassh"
        }
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.application" => "%{server}"
      }
      on_error => "server_not_found"
    }
    mutate {
      replace => {
        "token_target.location.country_or_region" =>
        "%{remote_location.country_code}: %{remote_location.region}"
      }
      on_error => "location_not_found"
    }
    if [location_not_found] {
      mutate {
        replace => {
          "token_target.location.country_or_region" =>
          "%{remote_location.country_code}"
        }
        on_error => "country_code_not_found"
      }
      mutate {
        replace => {
          "token_target.location.country_or_region" =>
          "%{remote_location.region}"
        }
        on_error => "region_not_found"
      }
    }

    mutate {
      replace => {
        "token_target.location.city" => "%{remote_location.city}"
      }
      on_error => "remote_location_city_not_found"
    }

    mutate {
      convert => {
        "remote_location.latitude" => "float"
      }
      on_error => "latitude_is_float"
    }
    mutate {
      rename => {
        "remote_location.latitude" =>
        "token_target.location.region_coordinates.latitude"
      }
    }

    mutate {
      convert => {
        "remote_location.longitude" => "float"
      }
      on_error => "longitude_is_float"
    }
    mutate {
      rename => {
        "remote_location.longitude" =>
        "token_target.location.region_coordinates.longitude"
      }
    }

    mutate {
      replace => {
        "var_hasshServer.value" => "%{hasshServer}"
      }
      on_error => "hasshServer_not_found"
    }
    if ![hasshServer_not_found] and [hasshServer] != "" {
      mutate {
        replace => {
          "var_hasshServer.key" => "hassh_server"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_hasshServer"
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "var_hasshVersion.value" => "%{hasshVersion}"
      }
      on_error => "hasshVersion_not_found"
    }
    if ![hasshVersion_not_found] and [hasshVersion] != "" {
      mutate {
        replace => {
          "var_hasshVersion.key" => "hassh_version"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_hasshVersion"
        }
      }
    }

    mutate {
      replace => {
        "var_cshka.value" => "%{cshka}"
      }
      on_error => "cshka_not_found"
    }
    if ![cshka_not_found] and [cshka] != "" {
      mutate {
        replace => {
          "var_cshka.key" => "cshka"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_cshka"
        }
      }
    }

    mutate {
      replace => {
        "var_hasshAlgorithms.value" => "%{hasshAlgorithms}"
      }
      on_error => "hasshAlgorithms_not_found"
    }
    if ![hasshAlgorithms_not_found] and [hasshAlgorithms] != "" {
      mutate {
        replace => {
          "var_hasshAlgorithms.key" => "hassh_algorithms"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_hasshAlgorithms"
        }
      }
    }

    mutate {
      replace => {
        "var_sshka.value" => "%{sshka}"
      }
      on_error => "sshka_not_found"
    }
    if ![sshka_not_found] and [sshka] != "" {
      mutate {
        replace => {
          "var_sshka.key" => "sshka"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_sshka"
        }
      }
    }

    mutate {
      replace => {
        "var_hasshServerAlgorithms.value" => "%{hasshServerAlgorithms}"
      }
      on_error => "hasshServerAlgorithms_not_found"
    }
    if ![hasshServerAlgorithms_not_found] and [hasshServerAlgorithms] != "" {
      mutate {
        replace => {
          "var_hasshServerAlgorithms.key" => "hassh_server_algorithms"
        }
      }
      mutate {
        merge => {
          "var_token_about.labels" => "var_hasshServerAlgorithms"
        }
      }
    }

    mutate {
      merge => {
        "var_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "var_token_about"
      }
      on_error => "var_token_about_not_found"
    }

    # UDM > Extensions
    mutate {
      convert => {
        "auth_attempts" => "string"
      }
      on_error => "auth_attempts_conversion_failed"
    }
    mutate {
      replace => {
        "token_extensions.auth.auth_details" =>
        "auth_attempts: %{auth_attempts}"
      }
      on_error => "auth_attempts_not_found"
    }

    # UDM > Security Results
    mutate {
      convert => {
        "auth_success" => "string"
      }
      on_error => "auth_success_conversion_failed"
    }
    mutate {
      replace => {
        "token_security_result.action_details" => "%{auth_success}"
      }
      on_error => "auth_success_not_found"
    }
    if ![auth_success_not_found] {
      if [auth_success] == "true" {
        mutate {
          replace => {
            "sr_action_allow" => "ALLOW"
          }
        }
      }
      else {
        mutate {
          replace => {
            "sr_action_allow" => "BLOCK"
          }
        }
      }
      mutate {
        merge => {
          "token_security_result.action" => "sr_action_allow"
        }
      }
    }

    mutate {
      replace => {
        "var_mac_alg.value" => "%{mac_alg}"
      }
      on_error => "mac_alg_not_found"
    }
    if ![mac_alg_not_found] and [mac_alg] != "" {
      mutate {
        replace => {
          "var_mac_alg.key" => "mac_alg"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "var_mac_alg"
        }
      }
    }

    mutate {
      replace => {
        "var_compression_alg.value" => "%{compression_alg}"
      }
      on_error => "compression_alg_not_found"
    }
    if ![compression_alg_not_found] and [compression_alg] != "" {
      mutate {
        replace => {
          "var_compression_alg.key" => "compression_alg"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "var_compression_alg"
        }
      }
    }

    mutate {
      replace => {
        "var_kex_alg.value" => "%{kex_alg}"
      }
      on_error => "kex_alg_not_found"
    }
    if ![kex_alg_not_found] and [kex_alg] != "" {
      mutate {
        replace => {
          "var_kex_alg.key" => "kex_alg"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "var_kex_alg"
        }
      }
    }

    mutate {
      replace => {
        "var_host_key_alg.value" => "%{host_key_alg}"
      }
      on_error => "host_key_alg_not_found"
    }
    if ![host_key_alg_not_found] and [host_key_alg] != "" {
      mutate {
        replace => {
          "var_host_key_alg.key" => "host_key_alg"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "var_host_key_alg"
        }
      }
    }

    mutate {
      replace => {
        "var_host_key.value" => "%{host_key}"
      }
      on_error => "host_key_not_found"
    }
    if ![host_key_not_found] and [host_key] != "" {
      mutate {
        replace => {
          "var_host_key.key" => "host_key"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "var_host_key"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "token_sec_res"
      }
    }
    mutate {
      merge => {
        "token_security_result" => "token_sec_res"
      }
      on_error => "token_sec_res_not_found"
    }

    # UDM > Security Results > Description
    for inference in inferences {
      mutate {
        replace => {
          "inf_security_result" => ""
        }
      }
      if [inference] == "ABP" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Client Authentication Bypass"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A client wasn't adhering to expectations of SSH either through server exploit or by the client and server switching to a protocol other than SSH after enctyption begins"
          }
        }
      }
      if [inference] == "AFR" {
        mutate {
          replace => {
            "inf_security_result.summary" => "SSH Agent Forwarding Requested"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "Agent Forwarding is requested by tge Client"
          }
        }
      }
      if [inference] == "APWA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Automated Password Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client authenticated with an automated password tool (like sshpass)"
          }
        }
      }
      if [inference] == "AUTO" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Automated Interaction"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client is a script automated utility and not driven by a user"
          }
        }
      }
      if [inference] == "BAN" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Server Banner"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The server sent the client a pre-authentication banner, likely for legal reasons"
          }
        }
      }
      if [inference] == "BF" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Client Brute Force Guessing"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A client made a number of authentication attempts that exceeded some configured, pre-connection threshold"
          }
        }
      }
      if [inference] == "BFS" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Client Brute Force Success"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A client made a number of authentication attempts that exceeded some configured, pre-connection threshold"
          }
        }
      }
      if [inference] == "CTS" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Client Trusted Server"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client already has an entry in its known_hosts file for this server"
          }
        }
      }
      if [inference] == "CUS" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Client Untrusted Server"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client did not have an entry in its known_hosts file for this server"
          }
        }
      }
      if [inference] == "IPWA" {
        mutate {
          replace => {
            "inf_security_result.summary" =>
            "Interactive Password Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client interactively typed their password to authenticate"
          }
        }
      }
      if [inference] == "KS" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Keystrokes"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "An interactive session occurred in which the client set user-driven keystrokes to the server"
          }
        }
      }
      if [inference] == "LFD" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Large Client File Donwload"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A file transfer occurred in which the server sent a sequence of bytes to the client"
          }
        }
      }
      if [inference] == "LFU" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Large Client File Upload"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A file transfer occurred in which the client sent a sequence of bytes to the server. Large file are identified dynamically based on trains of MTU-sized packets"
          }
        }
      }
      if [inference] == "MFA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Multifactor Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The server required a second form of authentication (a code) after password or public key was accepted, and the client successfully provided it"
          }
        }
      }
      if [inference] == "NA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "None Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client successfully authenticated using the None method"
          }
        }
      }
      if [inference] == "NRC" {
        mutate {
          replace => {
            "inf_security_result.summary" => "No Remote Command"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The -N flag was used in SSH authentication"
          }
        }
      }
      if [inference] == "PKA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Public Key Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client automatically authenticated using pubkey authentication"
          }
        }
      }
      if [inference] == "RSI" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Reverse SSH Initiated"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The Reverse session is initiated from the server back to the client"
          }
        }
      }
      if [inference] == "RSIA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Reverse SSH Initiated Automated"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The inititation of the Reverse session happened very early in the packet stream, indicating automation"
          }
        }
      }
      if [inference] == "RSK" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Reverse SSH Keystrokes"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "Keystrokes are detected within the Reverse tunnel"
          }
        }
      }
      if [inference] == "RSL" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Reverse SSH Logged In"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The Reverse Tunnel login has succeeded"
          }
        }
      }
      if [inference] == "RSP" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Reverse SSH Providioned"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client connected with -R flag, which provisions the port to be used for a Reverse Session set up at any future time"
          }
        }
      }
      if [inference] == "SA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Authentication Scanning"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client scanned authentication method with the server and then disconnected"
          }
        }
      }
      if [inference] == "SC" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Capabilities Scanning"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The client exchanged capabilities with the server and then disconnected"
          }
        }
      }
      if [inference] == "SFD" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Small Client File Download"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A file transfer occurred in which the server sent a sequence of bytes to the client"
          }
        }
      }
      if [inference] == "SFU" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Small Client File Upload"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A file transfer occurred in which the client sent a sequence of bytes to the server"
          }
        }
      }
      if [inference] == "SP" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Other Scanning"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A client and server didn't exchange encrypted packets but the client wasn't a version or capabilities scanner"
          }
        }
      }
      if [inference] == "SV" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Version Scanning"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "A client exchanged version strings with the server and than disconnected"
          }
        }
      }
      if [inference] == "UA" {
        mutate {
          replace => {
            "inf_security_result.summary" => "Unknown Authentication"
          }
        }
        mutate {
          replace => {
            "inf_security_result.description" =>
            "The authentication method is not determinated or is unknown"
          }
        }
      }
      mutate {
        merge => {
          "token_security_result" => "inf_security_result"
        }
        on_error => "sr_not_merge"
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }
  # ----------------------------------------------------------------------

  # ----------------------------------------------------------------------
  # IRC
  # - Implements base functionality for IRC analysis. The logging model is to log request/response pairs and all relevant metadata together in a single record.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/irc/main.zeek.html

  else if [_path] == "irc" {

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.user.user_display_name" => "%{nick}"
      }
      on_error => "nickname_not_found"
    }

    mutate {
      replace => {
        "user_id_check" => "%{user}"
      }
      on_error => "user_not_found"
    }
    if ![user_not_found] and [user] =~ "^(.*){0,255}$" {
      mutate {
        replace => {
          "token_principal.user.userid" => "%{user}"
        }
        on_error => "username_not_found"
      }
    }
    else {
      mutate {
        replace => {
          "var_user.value" => "%{user}"
        }
        on_error => "user_not_found"
      }
      if ![user_not_found] and [user] != "" {
        mutate {
          replace => {
            "var_user.key" => "user"
          }
        }
        mutate {
          merge => {
            "irc_about.labels" => "var_user"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_principal.process.command_line" => "%{command} %{value} %{addl}"
      }
      on_error => "command_value_addl_not_found"
    }

    # UDM > Src
    mutate {
      merge => {
        "token_src.file.names" => "dcc_file_name"
      }
      on_error => "dcc_file_name_not_found"
    }

    mutate {
      convert => {
        "dcc_file_size" => "uinteger"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "dcc_file_size" => "token_src.file.size"
        }
        on_error => "dcc_file_size_not_found"
      }
    }

    mutate {
      replace => {
        "token_src.file.mime_type" => "%{dcc_mime_type}"
      }
      on_error => "dcc_mime_type_not_found"
    }

    # UDM > About
    mutate {
      replace => {
        "var_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }
    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "var_fuid.key" => "fuid"
        }
      }
      mutate {
        merge => {
          "irc_about.labels" => "var_fuid"
        }
      }
    }

    mutate {
      merge => {
        "irc_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "irc_about"
      }
      on_error => "irc_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }

      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }

  }

  # ----------------------------------------------------------------------
  # RDP
  # - Implements base functionality for RDP analysis. The logging model is to log request/response pairs and all relevant metadata together in a single record.
  # - https://docs.zeek.org/en/current/scripts/base/protocols/rdp/main.zeek.html

  else if [_path] == "rdp" {

    # UDM > Principal

    mutate {
      replace => {
        "token_principal.hostname" => "%{client_name}"
      }
      on_error => "client_name_not_found"
    }

    mutate {
      replace => {
        "var_keyboard_layout.value" => "%{keyboard_layout}"
      }
      on_error => "keyboard_layout_not_found"
    }
    if ![keyboard_layout_not_found] and [keyboard_layout] != "" {
      mutate {
        replace => {
          "var_keyboard_layout.key" => "keyboard_layout"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_keyboard_layout"
        }
      }
    }

    mutate {
      replace => {
        "var_client_build.value" => "%{client_build}"
      }
      on_error => "client_build_not_found"
    }
    if ![client_build_not_found] and [client_build] != "" {
      mutate {
        replace => {
          "var_client_build.key" => "client_build"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_client_build"
        }
      }
    }

    mutate {
      replace => {
        "var_client_dig_product_id.value" => "%{client_dig_product_id}"
      }
      on_error => "client_dig_product_id_not_found"
    }
    if ![client_dig_product_id_not_found] and [client_dig_product_id] != "" {
      mutate {
        replace => {
          "var_client_dig_product_id.key" => "client_dig_product_id"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_client_dig_product_id"
        }
      }
    }

    mutate {
      convert => {
        "desktop_width" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_desktop_width.value" => "%{desktop_width}"
      }
      on_error => "desktop_width_not_found"
    }
    if ![desktop_width_not_found] and [desktop_width] != "" {
      mutate {
        replace => {
          "var_desktop_width.key" => "desktop_width"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_desktop_width"
        }
      }
    }

    mutate {
      convert => {
        "desktop_height" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_desktop_height.value" => "%{desktop_height}"
      }
      on_error => "desktop_height_not_found"
    }
    if ![desktop_height_not_found] and [desktop_height] != "" {
      mutate {
        replace => {
          "var_desktop_height.key" => "desktop_height"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_desktop_height"
        }
      }
    }

    mutate {
      replace => {
        "var_requested_color_depth.value" => "%{requested_color_depth}"
      }
      on_error => "requested_color_depth_not_found"
    }
    if ![requested_color_depth_not_found] and [requested_color_depth] != "" {
      mutate {
        replace => {
          "var_requested_color_depth.key" => "requested_color_depth"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_requested_color_depth"
        }
      }
    }

    mutate {
      replace => {
        "var_rdfp_string.value" => "%{rdfp_string}"
      }
      on_error => "rdfp_string_not_found"
    }
    if ![rdfp_string_not_found] and [rdfp_string] != "" {
      mutate {
        replace => {
          "var_rdfp_string.key" => "rdfp_string"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_rdfp_string"
        }
      }
    }

    mutate {
      replace => {
        "var_rdfp_hash.value" => "%{rdfp_hash}"
      }
      on_error => "rdfp_hash_not_found"
    }
    if ![rdfp_hash_not_found] and [rdfp_hash] != "" {
      mutate {
        replace => {
          "var_rdfp_hash.key" => "rdfp_hash"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "var_rdfp_hash"
        }
      }
    }

    # UDM > About

    mutate {
      replace => {
        "var_cookie.value" => "%{cookie}"
      }
      on_error => "cookie_not_found"
    }
    if ![cookie_not_found] and [cookie] != "" {
      mutate {
        replace => {
          "var_cookie.key" => "cookie"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_cookie"
        }
      }
    }

    mutate {
      replace => {
        "var_result.value" => "%{result}"
      }
      on_error => "result_not_found"
    }
    if ![result_not_found] and [result] != "" {
      mutate {
        replace => {
          "var_result.key" => "result"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_result"
        }
      }
    }

    mutate {
      replace => {
        "var_cert_type.value" => "%{cert_type}"
      }
      on_error => "cert_type_not_found"
    }
    if ![cert_type_not_found] and [cert_type] != "" {
      mutate {
        replace => {
          "var_cert_type.key" => "cert_type"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_cert_type"
        }
      }
    }

    mutate {
      convert => {
        "cert_count" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_cert_count.value" => "%{cert_count}"
      }
      on_error => "cert_count_not_found"
    }
    if ![cert_count_not_found] and [cert_count] != "" {
      mutate {
        replace => {
          "var_cert_count.key" => "cert_count"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_cert_count"
        }
      }
    }

    mutate {
      convert => {
        "cert_permanent" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_cert_permanent.value" => "%{cert_permanent}"
      }
      on_error => "cert_permanent_not_found"
    }
    if ![cert_permanent_not_found] and [cert_permanent] != "" {
      mutate {
        replace => {
          "var_cert_permanent.key" => "cert_permanent"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_cert_permanent"
        }
      }
    }

    mutate {
      replace => {
        "var_encryption_level.value" => "%{encryption_level}"
      }
      on_error => "encryption_level_not_found"
    }
    if ![encryption_level_not_found] and [encryption_level] != "" {
      mutate {
        replace => {
          "var_encryption_level.key" => "encryption_level"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_encryption_level"
        }
      }
    }

    mutate {
      replace => {
        "var_encryption_method.value" => "%{encryption_method}"
      }
      on_error => "encryption_method_not_found"
    }
    if ![encryption_method_not_found] and [encryption_method] != "" {
      mutate {
        replace => {
          "var_encryption_method.key" => "encryption_method"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_encryption_method"
        }
      }
    }

    mutate {
      convert => {
        "auth_success" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_auth_success.value" => "%{auth_success}"
      }
      on_error => "auth_success_not_found"
    }
    if ![auth_success_not_found] and [auth_success] != "" {
      mutate {
        replace => {
          "var_auth_success.key" => "auth_success"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_auth_success"
        }
      }
    }

    for inference in inferences {
      mutate {
        replace => {
          "var_inference" => ""
        }
      }
      mutate {
        replace => {
          "var_inference.value" => "%{inference}"
        }
        on_error => "inference_not_found"
      }
      if ![inference_not_found] and [inference] != "" {
        mutate {
          replace => {
            "var_inference.key" => "inferences"
          }
        }
        mutate {
          merge => {
            "token_about.labels" => "var_inference"
          }
        }
      }
    }

    mutate {
      replace => {
        "var_rdpeudp_uid.value" => "%{rdpeudp_uid}"
      }
      on_error => "rdpeudp_uid_not_found"
    }
    if ![rdpeudp_uid_not_found] and [rdpeudp_uid] != "" {
      mutate {
        replace => {
          "var_rdpeudp_uid.key" => "rdpeudp_uid"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "var_rdpeudp_uid"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "rdp_about"
      }
    }

    mutate {
      merge => {
        "rdp_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "rdp_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > Target
    mutate {
      replace => {
        "var_security_protocol.value" => "%{security_protocol}"
      }
      on_error => "security_protocol_not_found"
    }
    if ![security_protocol_not_found] and [security_protocol] != "" {
      mutate {
        replace => {
          "var_security_protocol.key" => "security_protocol"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "var_security_protocol"
        }
      }
    }

    # UDM > Intermediary
    for clientchannel in client_channels {
      mutate {
        replace => {
          "var_clientchannel" => ""
        }
      }
      mutate {
        replace => {
          "var_clientchannel.value" => "%{clientchannel}"
        }
        on_error => "clientchannel_not_found"
      }
      if ![clientchannel_not_found] and [clientchannel] != "" {
        mutate {
          replace => {
            "var_clientchannel.key" => "clientchannels"
          }
        }
        mutate {
          merge => {
            "token_intermediary.labels" => "var_clientchannel"
          }
        }
      }
    }

    mutate {
      convert => {
        "channels_joined" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "var_channels_joined.value" => "%{channels_joined}"
      }
      on_error => "channels_joined_not_found"
    }
    if ![channels_joined_not_found] and [channels_joined] != "" {
      mutate {
        replace => {
          "var_channels_joined.key" => "channels_joined"
        }
      }
      mutate {
        merge => {
          "token_intermediary.labels" => "var_channels_joined"
        }
      }
    }

    mutate {
      rename => {
        "token_intermediary" => "rdp_intermediary"
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "rdp_intermediary"
      }
      on_error => "failed_to_merge_intermediary"
    }

    # UDM > Network > IP Protocol
    mutate {
      replace => {
        "token_network.ip_protocol" => "TCP"
      }
    }

    # UDM > Security Results
    mutate {
      replace => {
        "rdp_security_result.description" =>
        "%{result} connection with security protocol %{security_protocol}"
      }
      on_error => "rdp_security_result_description_field_not_set"
    }

    mutate {
      replace => {
        "rdp_security_result.severity" => "INFORMATIONAL"
      }
      on_error => "rdp_security_result_severity_field_not_set"
    }

    mutate {
      merge => {
        "token_security_result" => "rdp_security_result"
      }
      on_error => "rdp_security_result_not_set"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }

      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }

  }

  # ----------------------------------------------------------------------
  # CONN
  # - tracking/logging of general information regarding TCP, UDP, and ICMP traffic.
  # - For UDP and ICMP, connections are to be interpreted using flow semantics (sequence of packets from a source host/port to a destination host/port).
  # - Further, ICMP “ports” are to be interpreted as the source port meaning the ICMP message type and the destination port being the ICMP message code.
  # - https://docs.corelight.com/docs/sensor/reference/logs/conn.html
  # - https://docs.corelight.com/docs/sensor/reference/logs/conn_red.html
  # - https://docs.corelight.com/docs/sensor/reference/logs/conn_long.html

  else if [_path] == "conn" or [_path] == "conn_red" or [_path] == "conn_long" {

    # UDM > Metadata

    mutate {
      replace => {
        "token_metadata.description" => "%{conn_state}"
      }
      on_error => "conn_state_not_set"
    }

    if ![conn_state_not_set] {
      if [conn_state] == "S0" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection attempt seen, no reply"
          }
        }
      }
      else if [conn_state] == "S1" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection established, not terminated"
          }
        }
      }
      else if [conn_state] == "S2" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection established and close attempt by originator seen (but no reply from responder)"
          }
        }
      }
      else if [conn_state] == "S3" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection established and close attempt by responder seen (but no reply from originator)"
          }
        }
      }
      else if [conn_state] == "SF" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Normal SYN/FIN completion"
          }
        }
      }
      else if [conn_state] == "REJ" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection attempt rejected"
          }
        }
      }
      else if [conn_state] == "RSTO" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Connection established, originator aborted (sent a RST)"
          }
        }
      }
      else if [conn_state] == "RSTOS0" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Originator sent a SYN followed by a RST, we never saw a SYN-ACK from the responder"
          }
        }
      }
      else if [conn_state] == "RSTOSH" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Responder sent a SYN ACK followed by a RST, we never saw a SYN from the (purported) originator"
          }
        }
      }
      else if [conn_state] == "RSTR" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Established, responder aborted"
          }
        }
      }
      else if [conn_state] == "SH" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was “half” open)"
          }
        }
      }
      else if [conn_state] == "SHR" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: Responder sent a SYN ACK followed by a FIN, we never saw a SYN from the originator"
          }
        }
      }
      else if [conn_state] == "OTH" {
        mutate {
          replace => {
            "token_metadata.description" =>
            "%{conn_state}: No SYN seen, just midstream traffic (a partial connection that was not later closed)"
          }
        }
      }
    }

    # UDM > Network
    mutate {
      replace => {
        "proto" => "%{proto}"
      }
      on_error => "proto_not_set"
    }

    if ![proto_not_set] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_service.value" => "%{service}"
      }
      on_error => "token_service_not_set"
    }

    if ![token_service_not_set] and [token_service][value] != "" {
      mutate {
        replace => {
          "token_service.key" => "service"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_service"
        }
      }
    }

    mutate {
      replace => {
        "service" => "%{service}"
      }
      on_error => "service_not_set"
    }

    if ![service_not_set] {
      mutate {
        uppercase => ["service"]
      }

      if [service] in ["AFP", "AMQP", "APPC", "ATOM", "BEEP", "BIT_TORRENT",
      "BITCOIN", "CFDP", "COAP", "DCERPC", "DDS", "DEVICE_NET", "DHCP",
      "DNS", "E_DONKEY", "ENRP", "FAST_TRACK", "FINGER", "FREENET", "FTAM",
      "GOPHER", "H323", "HL7", "HTTP", "HTTPS", "IRCP", "KADEMLIA", "KRB5",
      "LDAP", "LPD", "MIME", "MODBUS", "MQTT", "NETCONF", "NFS", "NIS",
      "NNTP", "NTCIP", "NTP", "OSCAR", "PNRP", "QUIC", "RDP", "RELP", "RIP",
      "RLOGIN", "RPC", "RTMP", "RTP", "RTPS", "RTSP", "SAP", "SDP", "SIP",
      "SLP", "SMB", "SMTP", "SNTP", "SSH", "SSMS", "STYX", "TCAP", "TDS",
      "TOR", "TSP", "VTP", "WEB_DAV", "WHOIS", "X400", "X500", "XMPP"] {
        mutate {
          replace => {
            "token_network.application_protocol" => "%{service}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.application_protocol" =>
            "UNKNOWN_APPLICATION_PROTOCOL"
          }
        }
      }
    }

    mutate {
      convert => {
        "duration" => "integer"
      }
      on_error => "conversion_error"
    }

    if ![conversion_error] {
      mutate {
        rename => {
          "duration" => "token_network.session_duration.seconds"
        }
        on_error => "duration_not_found"
      }
    }

    mutate {
      convert => {
        "orig_bytes" => "uinteger"
      }
      on_error => "failed_to_convert_orig_bytes"
    }

    mutate {
      rename => {
        "orig_bytes" => "token_network.sent_bytes"
      }
      on_error => "orig_bytes_not_set"
    }

    mutate {
      convert => {
        "resp_bytes" => "uinteger"
      }
      on_error => "failed_to_convert_resp_bytes"
    }

    mutate {
      rename => {
        "resp_bytes" => "token_network.received_bytes"
      }
      on_error => "resp_bytes_not_set"
    }

    mutate {
      convert => {
        "orig_pkts" => "integer"
      }
      on_error => "failed_to_convert_orig_pkts"
    }

    mutate {
      rename => {
        "orig_pkts" => "token_network.sent_packets"
      }
      on_error => "orig_pkts_not_set"
    }

    mutate {
      convert => {
        "resp_pkts" => "integer"
      }
      on_error => "failed_to_convert_resp_pkts"
    }

    mutate {
      rename => {
        "resp_pkts" => "token_network.received_packets"
      }
      on_error => "resp_pkts_not_set"
    }

    mutate {
      replace => {
        "token_network.community_id" => "%{community_id}"
      }
      on_error => "community_id_not_set"
    }

    # UDM > Principal
    mutate {
      convert => {
        "orig_ip_bytes" => "string"
      }
      on_error => "failed_to_convert_orig_ip_bytes"
    }

    mutate {
      replace => {
        "token_orig_ip_bytes.value" => "%{orig_ip_bytes}"
      }
      on_error => "orig_ip_bytes_not_set"
    }

    if ![orig_ip_bytes_not_set] and [orig_ip_bytes] != "" {
      mutate {
        replace => {
          "token_orig_ip_bytes.key" => "orig_ip_bytes"
        }
      }

      mutate {
        merge => {
          "token_principal.labels" => "token_orig_ip_bytes"
        }
      }
    }

    mutate {
      replace => {
        "token_ip_geo_artifact.location.country_or_region" => "%{orig_cc}"
      }
      on_error => "orig_cc_not_set"
    }

    mutate {
      merge => {
        "token_principal.ip_geo_artifact" => "token_ip_geo_artifact"
      }
      on_error => "failed_merge_orig_cc"
    }

    mutate {
      convert => {
        "orig_shunted_pkts" => "string"
      }
      on_error => "failed_to_convert_orig_shunted_pkts"
    }

    mutate {
      replace => {
        "token_orig_shunted_pkts.value" => "%{orig_shunted_pkts}"
      }
      on_error => "orig_shunted_pkts_not_set"
    }

    if ![orig_shunted_pkts_not_set] and [orig_shunted_pkts] != "" {
      mutate {
        replace => {
          "token_orig_shunted_pkts.key" => "orig_shunted_pkts"
        }
      }

      mutate {
        merge => {
          "token_principal.labels" => "token_orig_shunted_pkts"
        }
      }
    }

    mutate {
      convert => {
        "orig_shunted_bytes" => "string"
      }
      on_error => "failed_to_convert_orig_shunted_bytes"
    }

    mutate {
      replace => {
        "token_orig_shunted_bytes.value" => "%{orig_shunted_bytes}"
      }
      on_error => "orig_shunted_bytes_not_set"
    }

    if ![orig_shunted_bytes_not_set] and [orig_shunted_bytes] != "" {
      mutate {
        replace => {
          "token_orig_shunted_bytes.key" => "orig_shunted_bytes"
        }
      }

      mutate {
        merge => {
          "token_principal.labels" => "token_orig_shunted_bytes"
        }
      }
    }

    grok {
      match => {
        "orig_l2_addr" => "%{MAC:orig_l2_addr}"
      }
      overwrite => ["orig_l2_addr"]
      on_error => "mac_not_vaild"
    }

    if ![mac_not_vaild] {
      mutate {
        merge => {
          "token_principal.mac" => "orig_l2_addr"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "token_id_orig_h_n_src.value" => "%{id_orig_h_n.src}"
      }
      on_error => "id_orig_h_n_src_not_set"
    }

    if ![id_orig_h_n_src_not_set] and [id_orig_h_n][src] != "" {
      mutate {
        replace => {
          "token_id_orig_h_n_src.key" => "id_orig_h_n_src"
        }
      }

      mutate {
        merge => {
          "token_principal.labels" => "token_id_orig_h_n_src"
        }
      }
    }

    for index, orig_h_n_val in id_orig_h_n.vals {
      mutate {
        replace => {
          "token_orig_h_n_val" => ""
        }
      }

      mutate {
        replace => {
          "token_orig_h_n_val.value" => "%{orig_h_n_val}"
        }
        on_error => "orig_h_n_val_not_set"
      }

      if ![orig_h_n_val_not_set] and [orig_h_n_val] != "" {
        mutate {
          replace => {
            "token_orig_h_n_val.key" => "id_orig_h_n_val"
          }
        }

        mutate {
          merge => {
            "token_principal.labels" => "token_orig_h_n_val"
          }
        }
      }
    }

    # UDM > Target
    mutate {
      convert => {
        "resp_ip_bytes" => "string"
      }
      on_error => "failed_to_convert_resp_ip_bytes"
    }

    mutate {
      replace => {
        "token_resp_ip_bytes.value" => "%{resp_ip_bytes}"
      }
      on_error => "resp_ip_bytes_not_set"
    }

    if ![resp_ip_bytes_not_set] and [resp_ip_bytes] != "" {
      mutate {
        replace => {
          "token_resp_ip_bytes.key" => "resp_ip_bytes"
        }
      }

      mutate {
        merge => {
          "token_target.labels" => "token_resp_ip_bytes"
        }
      }
    }

    mutate {
      replace => {
        "target_ip_geo_artifact.location.country_or_region" => "%{resp_cc}"
      }
      on_error => "resp_cc_not_set"
    }

    mutate {
      merge => {
        "token_target.ip_geo_artifact" => "target_ip_geo_artifact"
      }
      on_error => "failed_to_merge_orig_cc"
    }

    mutate {
      convert => {
        "resp_shunted_pkts" => "string"
      }
      on_error => "failed_to_convert_resp_shunted_pkts"
    }

    mutate {
      replace => {
        "token_resp_shunted_pkts.value" => "%{resp_shunted_pkts}"
      }
      on_error => "resp_shunted_pkts_not_set"
    }

    if ![resp_shunted_pkts_not_set] and [resp_shunted_pkts] != "" {
      mutate {
        replace => {
          "token_resp_shunted_pkts.key" => "resp_shunted_pkts"
        }
      }

      mutate {
        merge => {
          "token_target.labels" => "token_resp_shunted_pkts"
        }
      }
    }

    mutate {
      convert => {
        "resp_shunted_bytes" => "string"
      }
      on_error => "failed_to_convert_resp_shunted_bytes"
    }

    mutate {
      replace => {
        "token_resp_shunted_bytes.value" => "%{resp_shunted_bytes}"
      }
      on_error => "resp_shunted_bytes_not_set"
    }

    if ![resp_shunted_bytes_not_set] and [resp_shunted_bytes] != "" {
      mutate {
        replace => {
          "token_resp_shunted_bytes.key" => "resp_shunted_bytes"
        }
      }

      mutate {
        merge => {
          "token_target.labels" => "token_resp_shunted_bytes"
        }
      }
    }

    grok {
      match => {
        "resp_l2_addr" => "%{MAC:resp_l2_addr}"
      }
      overwrite => ["resp_l2_addr"]
      on_error => "mac_not_vaild"
    }

    if ![mac_not_vaild] {
      mutate {
        merge => {
          "token_target.mac" => "resp_l2_addr"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "token_id_resp_h_n_src.value" => "%{id_resp_h_n.src}"
      }
      on_error => "id_resp_h_n_src_not_set"
    }

    if ![id_resp_h_n_src_not_set] and [id_resp_h_n][src] != "" {
      mutate {
        replace => {
          "token_id_resp_h_n_src.key" => "id_resp_h_n_src"
        }
      }

      mutate {
        merge => {
          "token_target.labels" => "token_id_resp_h_n_src"
        }
      }
    }

    for index, resp_h_n_val in id_resp_h_n.vals {
      mutate {
        replace => {
          "token_resp_h_n_val" => ""
        }
      }

      mutate {
        replace => {
          "token_resp_h_n_val.value" => "%{resp_h_n_val}"
        }
        on_error => "resp_h_n_val_not_set"
      }

      if ![resp_h_n_val_not_set] and [resp_h_n_val] != "" {
        mutate {
          replace => {
            "token_resp_h_n_val.key" => "id_resp_h_n_val"
          }
        }

        mutate {
          merge => {
            "token_target.labels" => "token_resp_h_n_val"
          }
        }
      }
    }

    # UDM > Intermediary
    for tunnelparent in tunnel_parents {
      mutate {
        replace => {
          "token_tunnel_parent" => ""
        }
      }

      mutate {
        replace => {
          "token_tunnel_parent.value" => "%{tunnelparent}"
        }
        on_error => "tunnel_parent_not_set"
      }

      if ![tunnel_parent_not_set] and [tunnelparent] != "" {
        mutate {
          replace => {
            "token_tunnel_parent.key" => "tunnel_parent"
          }
        }

        mutate {
          merge => {
            "token_intermediary.labels" => "token_tunnel_parent"
          }
        }
      }
    }

    mutate {
      convert => {
        "vlan" => "string"
      }
      on_error => "failed_to_convert_vlan"
    }

    mutate {
      replace => {
        "token_vlan.value" => "%{vlan}"
      }
      on_error => "vlan_not_set"
    }

    if ![vlan_not_set] and [vlan] != "" {
      mutate {
        replace => {
          "token_vlan.key" => "vlan"
        }
      }

      mutate {
        merge => {
          "token_intermediary.labels" => "token_vlan"
        }
      }
    }

    mutate {
      convert => {
        "inner_vlan" => "string"
      }
      on_error => "failed_to_convert_inner_vlan"
    }

    mutate {
      replace => {
        "token_inner_vlan.value" => "%{inner_vlan}"
      }
      on_error => "inner_vlan_not_set"
    }

    if ![inner_vlan_not_set] and [inner_vlan] != "" {
      mutate {
        replace => {
          "token_inner_vlan.key" => "inner_vlan"
        }
      }

      mutate {
        merge => {
          "token_intermediary.labels" => "token_inner_vlan"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "local_orig" => "string"
      }
      on_error => "failed_to_convert_local_orig"
    }

    mutate {
      replace => {
        "token_local_orig.value" => "%{local_orig}"
      }
      on_error => "local_orig_not_set"
    }

    if ![local_orig_not_set] and [local_orig] != "" {
      mutate {
        replace => {
          "token_local_orig.key" => "local_orig"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_local_orig"
        }
      }
    }

    mutate {
      merge => {
        "token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "local_resp" => "string"
      }
      on_error => "failed_to_convert_local_resp"
    }

    mutate {
      replace => {
        "token_local_resp.value" => "%{local_resp}"
      }
      on_error => "local_resp_not_set"
    }

    if ![local_resp_not_set] and [local_resp] != "" {
      mutate {
        replace => {
          "token_local_resp.key" => "local_resp"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_local_resp"
        }
      }
    }

    mutate {
      convert => {
        "missed_bytes" => "string"
      }
      on_error => "failed_to_convert_missed_bytes"
    }

    mutate {
      replace => {
        "token_missed_bytes.value" => "%{missed_bytes}"
      }
      on_error => "missed_bytes_not_set"
    }

    if ![missed_bytes_not_set] and [missed_bytes] != "" {
      mutate {
        replace => {
          "token_missed_bytes.key" => "missed_bytes"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_missed_bytes"
        }
      }
    }

    mutate {
      replace => {
        "token_history.value" => "%{history}"
      }
      on_error => "history_not_set"
    }

    if ![history_not_set] and [history] != "" {
      mutate {
        replace => {
          "token_history.key" => "history"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_history"
        }
      }
    }

    mutate {
      replace => {
        "token_about.url" => "%{url}"
      }
      on_error => "url_not_set"
    }

    mutate {
      convert => {
        "corelight_shunted" => "string"
      }
      on_error => "failed_to_convert_corelight_shunted"
    }
    mutate {
      replace => {
        "token_corelight_shunted.value" => "%{corelight_shunted}"
      }
      on_error => "corelight_shunted_not_set"
    }

    if ![corelight_shunted_not_set] and [corelight_shunted] != "" {
      mutate {
        replace => {
          "token_corelight_shunted.key" => "corelight_shunted"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_corelight_shunted"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "conn_about"
      }
    }

    for index, application in app {
      if [index] == 0 {
        mutate {
          replace => {
            "conn_about.application" => "%{application}"
          }
          on_error => "application_not_set"
        }
      }
      else {
        mutate {
          replace => {
            "application_about" => ""
          }
        }

        mutate {
          replace => {
            "application_about.application" => "%{application}"
          }
          on_error => "application_not_set"
        }

        mutate {
          merge => {
            "token_about" => "application_about"
          }
          on_error => "failed_to_merge_about"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "conn_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "orig_ep_cid" => "string"
      }
      on_error => "orig_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "orig_ep_cid_label.value.string_value" => "%{orig_ep_cid}"
      }
      on_error => "orig_ep_cid_not_found"
    }

    if ![orig_ep_cid_not_found] and
      [orig_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "orig_ep_cid_label.key" => "orig_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "orig_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "orig_ep_source" => "string"
      }
      on_error => "orig_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "orig_ep_source_label.value.string_value" => "%{orig_ep_source}"
      }
      on_error => "orig_ep_source_not_found"
    }

    if ![orig_ep_source_not_found] and
      [orig_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "orig_ep_source_label.key" => "orig_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "orig_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "orig_ep_status" => "string"
      }
      on_error => "orig_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "orig_ep_status_label.value.string_value" => "%{orig_ep_status}"
      }
      on_error => "orig_ep_status_not_found"
    }

    if ![orig_ep_status_not_found] and
      [orig_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "orig_ep_status_label.key" => "orig_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "orig_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "orig_ep_uid" => "string"
      }
      on_error => "orig_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "orig_ep_uid_label.value.string_value" => "%{orig_ep_uid}"
      }
      on_error => "orig_ep_uid_not_found"
    }

    if ![orig_ep_uid_not_found] and
      [orig_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "orig_ep_uid_label.key" => "orig_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "orig_ep_uid_label"
        }
      }
    }

    mutate {
      convert => {
        "resp_ep_cid" => "string"
      }
      on_error => "resp_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "resp_ep_cid_label.value.string_value" => "%{resp_ep_cid}"
      }
      on_error => "resp_ep_cid_not_found"
    }

    if ![resp_ep_cid_not_found] and
      [resp_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "resp_ep_cid_label.key" => "resp_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "resp_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "resp_ep_source" => "string"
      }
      on_error => "resp_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "resp_ep_source_label.value.string_value" => "%{resp_ep_source}"
      }
      on_error => "resp_ep_source_not_found"
    }

    if ![resp_ep_source_not_found] and
      [resp_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "resp_ep_source_label.key" => "resp_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "resp_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "resp_ep_status" => "string"
      }
      on_error => "resp_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "resp_ep_status_label.value.string_value" => "%{resp_ep_status}"
      }
      on_error => "resp_ep_status_not_found"
    }

    if ![resp_ep_status_not_found] and
      [resp_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "resp_ep_status_label.key" => "resp_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "resp_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "resp_ep_uid" => "string"
      }
      on_error => "resp_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "resp_ep_uid_label.value.string_value" => "%{resp_ep_uid}"
      }
      on_error => "resp_ep_uid_not_found"
    }

    if ![resp_ep_uid_not_found] and
      [resp_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "resp_ep_uid_label.key" => "resp_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "resp_ep_uid_label"
        }
      }
    }

    # UDM > Security Results
    mutate {
      convert => {
        "spcap.rule" => "string"
      }
      on_error => "failed_to_convert_spcap_rule"
    }

    mutate {
      replace => {
        "token_spcap_rule.value" => "%{spcap.rule}"
      }
      on_error => "spcap_rule_not_set"
    }

    if ![spcap_rule_not_set] and [spcap][rule] != "" {
      mutate {
        replace => {
          "token_spcap_rule.key" => "spcap_rule"
        }
      }

      mutate {
        merge => {
          "token_security_result.rule_labels" => "token_spcap_rule"
        }
      }
    }

    mutate {
      replace => {
        "token_security_result.severity" => "INFORMATIONAL"
      }
    }

    mutate {
      replace => {
        "token_spcap_trigger.value" => "%{spcap.trigger}"
      }
      on_error => "spcap_trigger_not_set"
    }

    if ![spcap_trigger_not_set] and [spcap][trigger] != "" {
      mutate {
        replace => {
          "token_spcap_trigger.key" => "spcap_trigger"
        }
      }

      mutate {
        merge => {
          "token_security_result.detection_fields" => "token_spcap_trigger"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "conn_security_result"
      }
    }

    for index, suri_id in suri_ids {
      if [index] == 0 {
        mutate {
          replace => {
            "conn_security_result.rule_id" => "%{suri_id}"
          }
          on_error => "suri_id_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "temp_security_result" => ""
          }
        }

        mutate {
          replace => {
            "temp_security_result.rule_id" => "%{suri_id}"
          }
          on_error => "suri_id_not_found"
        }

        mutate {
          merge => {
            "token_security_result" => "temp_security_result"
          }
          on_error => "failed_to_merge_security_result"
        }
      }
    }

    mutate {
      replace => {
        "conn_security_result.url_back_to_product" => "%{spcap.url}"
      }
      on_error => "spcap_url_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "conn_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    mutate {
      rename => {
        "token_intermediary" => "conn_intermediary"
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "conn_intermediary"
      }
      on_error => "failed_to_merge_token_intermediary"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # FILES
  # - https://docs.corelight.com/docs/sensor/reference/logs/files.html
  # - https://docs.corelight.com/docs/sensor/reference/logs/files_red.html
  else if [_path] == "files" or [_path] == "files_red" {

    mutate {
      replace => {
        "target_file" => "false"
      }
    }

    # UDM > Principal
    for txhost in tx_hosts {
      grok {
        match => {
          "txhost" => "%{IP:txhost}"
        }
        overwrite => ["txhost"]
        on_error => "ip_not_vaild"
      }

      if ![ip_not_vaild] {
        mutate {
          merge => {
            "token_principal.ip" => "txhost"
          }
        }

        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
    }

    # UDM > Target
    for rxhost in rx_hosts {
      grok {
        match => {
          "rxhost" => "%{IP:rxhost}"
        }
        overwrite => ["rxhost"]
        on_error => "ip_not_vaild"
      }

      if ![ip_not_vaild] {
        mutate {
          merge => {
            "token_target.ip" => "rxhost"
          }
        }

        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
    }

    # UDM > About

    mutate {
      convert => {
        "depth" => "string"
      }
      on_error => "failed_to_convert_depth"
    }

    mutate {
      replace => {
        "token_depth.value" => "%{depth}"
      }
      on_error => "depth_not_set"
    }

    if ![depth_not_set] and [depth] != "" {
      mutate {
        replace => {
          "token_depth.key" => "depth"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_depth"
        }
      }
    }

    for analyzer in analyzers {
      mutate {
        replace => {
          "token_analyzer" => ""
        }
      }
      mutate {
        replace => {
          "token_analyzer.value" => "%{analyzer}"
        }
        on_error => "analyzer_not_set"
      }

      if ![analyzer_not_set] and [analyzer] != "" {
        mutate {
          replace => {
            "token_analyzer.key" => "analyzer"
          }
        }

        mutate {
          merge => {
            "token_about.labels" => "token_analyzer"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_about.file.mime_type" => "%{mime_type}"
      }
      on_error => "mime_type_not_found"
    }

    mutate {
      merge => {
        "token_about.file.names" => "filename"
      }
      on_error => "filename_not_found"
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "failed_to_convert_duration"
    }

    mutate {
      replace => {
        "token_duration.value" => "%{duration}"
      }
      on_error => "duration_not_set"
    }

    if ![duration_not_set] and [duration] != "" {
      mutate {
        replace => {
          "token_duration.key" => "duration"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_duration"
        }
      }
    }

    mutate {
      convert => {
        "seen_bytes" => "uinteger"
      }
      on_error => "failed_to_convert_seen_bytes"
    }

    mutate {
      rename => {
        "seen_bytes" => "token_about.file.size"
      }
      on_error => "seen_bytes_not_found"
    }

    mutate {
      convert => {
        "total_bytes" => "string"
      }
      on_error => "failed_to_convert_total_bytes"
    }

    mutate {
      replace => {
        "token_total_bytes.value" => "%{total_bytes}"
      }
      on_error => "total_bytes_not_set"
    }

    if ![total_bytes_not_set] and [total_bytes] != "" {
      mutate {
        replace => {
          "token_total_bytes.key" => "total_bytes"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_total_bytes"
        }
      }
    }

    mutate {
      convert => {
        "missing_bytes" => "string"
      }
      on_error => "failed_to_convert_missing_bytes"
    }

    mutate {
      replace => {
        "token_missing_bytes.value" => "%{missing_bytes}"
      }
      on_error => "missing_bytes_not_set"
    }

    if ![missing_bytes_not_set] and [missing_bytes] != "" {
      mutate {
        replace => {
          "token_missing_bytes.key" => "missing_bytes"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_missing_bytes"
        }
      }
    }

    mutate {
      convert => {
        "overflow_bytes" => "string"
      }
      on_error => "failed_to_convert_overflow_bytes"
    }

    mutate {
      replace => {
        "token_overflow_bytes.value" => "%{overflow_bytes}"
      }
      on_error => "overflow_bytes_not_set"
    }

    if ![overflow_bytes_not_set] and [overflow_bytes] != "" {
      mutate {
        replace => {
          "token_overflow_bytes.key" => "overflow_bytes"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_overflow_bytes"
        }
      }
    }

    mutate {
      convert => {
        "parent_fuid" => "string"
      }
      on_error => "failed_to_convert_parent_fuid"
    }

    mutate {
      replace => {
        "token_parent_fuid.value" => "%{parent_fuid}"
      }
      on_error => "parent_fuid_not_set"
    }

    if ![parent_fuid_not_set] and [parent_fuid] != "" {
      mutate {
        replace => {
          "token_parent_fuid.key" => "parent_fuid"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_parent_fuid"
        }
      }
    }

    mutate {
      replace => {
        "md5" => "%{md5}"
      }
      on_error => "md5_not_set"
    }

    if ![md5_not_set] and [md5] =~ "^[a-f0-9]{32}$" {
      mutate {
        replace => {
          "token_about.file.md5" => "%{md5}"
        }
      }
    }

    mutate {
      replace => {
        "sha1" => "%{sha1}"
      }
      on_error => "sha1_not_set"
    }

    if ![sha1_not_set] and [sha1] =~ "^[a-f0-9]{40}$" {
      mutate {
        replace => {
          "token_about.file.sha1" => "%{sha1}"
        }
      }
    }

    mutate {
      replace => {
        "sha256" => "%{sha256}"
      }
      on_error => "sha256_not_set"
    }

    if ![sha256_not_set] and [sha256] =~ "^[a-f0-9]{64}$" {
      mutate {
        replace => {
          "token_about.file.sha256" => "%{sha256}"
        }
      }
    }

    mutate {
      replace => {
        "token_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }

    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "token_fuid.key" => "fuid"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_fuid"
        }
      }
    }

    for connuid in conn_uids {
      mutate {
        replace => {
          "token_connuid" => ""
        }
      }
      mutate {
        replace => {
          "token_connuid.value" => "%{connuid}"
        }
        on_error => "connuid_not_set"
      }

      if ![connuid_not_set] and [connuid] != "" {
        mutate {
          replace => {
            "token_connuid.key" => "conn_uid"
          }
        }

        mutate {
          merge => {
            "token_about.labels" => "token_connuid"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_source.value" => "%{source}"
      }
      on_error => "source_not_found"
    }

    if ![source_not_found] and [source] != "" {
      mutate {
        replace => {
          "token_source.key" => "source"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_source"
        }
      }
    }

    if ![source_not_found] and [source] =~ "(?i)ssl"
    and ![mime_type_not_found] {
      if [mime_type] == "application/x-x509-user-cert" {
        if ![md5_not_set] and [md5] =~ "^[a-fA-F0-9]{32}$" {
          mutate {
            replace => {
              "token_network.tls.client.certificate.md5" => "%{md5}"
            }
          }
        }
        if ![sha256_not_set] and [sha256] =~ "^[a-fA-F0-9]{64}$" {
          mutate {
            replace => {
              "token_network.tls.client.certificate.sha256" => "%{sha256}"
            }
          }
        }
        if ![sha1_not_set] and [sha1] =~ "^[a-fA-F0-9]{40}$" {
          mutate {
            replace => {
              "token_network.tls.client.certificate.sha1" => "%{sha1}"
            }
          }
        }
      }
      else if [mime_type] == "application/x-x509-ca-cert" {
        if ![md5_not_set] and [md5] =~ "^[a-fA-F0-9]{32}$" {
          mutate {
            replace => {
              "token_network.tls.server.certificate.md5" => "%{md5}"
            }
          }
        }
        if ![sha256_not_set] and [sha256] =~ "^[a-fA-F0-9]{64}$" {
          mutate {
            replace => {
              "token_network.tls.server.certificate.sha256" => "%{sha256}"
            }
          }
        }
        if ![sha1_not_set] and [sha1] =~ "^[a-fA-F0-9]{40}$" {
          mutate {
            replace => {
              "token_network.tls.server.certificate.sha1" => "%{sha1}"
            }
          }
        }
      }
    }

    mutate {
      convert => {
        "local_orig" => "string"
      }
      on_error => "failed_to_convert_local_orig"
    }

    mutate {
      replace => {
        "token_local_orig.value" => "%{local_orig}"
      }
      on_error => "local_orig_not_set"
    }

    if ![local_orig_not_set] and [local_orig] != "" {
      mutate {
        replace => {
          "token_local_orig.key" => "local_orig"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_local_orig"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "failed_to_convert_is_orig"
    }

    mutate {
      replace => {
        "token_is_orig.value" => "%{is_orig}"
      }
      on_error => "is_orig_not_set"
    }

    if ![is_orig_not_set] and [is_orig] != "" {
      mutate {
        replace => {
          "token_is_orig.key" => "is_orig"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_is_orig"
        }
      }
    }

    mutate {
      convert => {
        "timedout" => "string"
      }
      on_error => "failed_to_convert_timedout"
    }
    mutate {
      replace => {
        "token_timedout.value" => "%{timedout}"
      }
      on_error => "timedout_not_set"
    }

    if ![timedout_not_set] and [timedout] != "" {
      mutate {
        replace => {
          "token_timedout.key" => "timedout"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_timedout"
        }
      }
    }

    mutate {
      convert => {
        "extracted_cutoff" => "string"
      }
      on_error => "failed_to_convert_extracted_cutoff"
    }

    mutate {
      replace => {
        "token_extracted_cutoff.value" => "%{extracted_cutoff}"
      }
      on_error => "extracted_cutoff_not_set"
    }

    if ![extracted_cutoff_not_set] and [extracted_cutoff] != "" {
      mutate {
        replace => {
          "token_extracted_cutoff.key" => "extracted_cutoff"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_extracted_cutoff"
        }
      }
    }

    mutate {
      convert => {
        "extracted_size" => "string"
      }
      on_error => "extracted_size_conversion_error"
    }

    mutate {
      replace => {
        "extracted_size_labels.value" => "%{extracted_size}"
      }
      on_error => "extracted_size_not_found"
    }
    if ![extracted_size_not_found] and [extracted_size] != "" {
      mutate {
        replace => {
          "extracted_size_labels.key" => "extracted_size"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "extracted_size_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about.file.names" => "extracted"
      }
      on_error => "extracted_ele_not_found"
    }

    mutate {
      rename => {
        "token_about" => "files_about"
      }
    }

    mutate {
      convert => {
        "num" => "string"
      }
      on_error => "failed_to_convert_num"
    }

    mutate {
      replace => {
        "token_num.value" => "%{num}"
      }
      on_error => "num_not_found"
    }

    if ![num_not_found] and [num] != "" {
      mutate {
        replace => {
          "token_num.key" => "num"
        }
      }

      mutate {
        merge => {
          "files_about.labels" => "token_num"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "files_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "vlan" => "string"
      }
      on_error => "vlan_conversion_error"
    }

    mutate {
      replace => {
        "vlan_label.value.string_value" => "%{vlan}"
      }
      on_error => "vlan_not_found"
    }

    if ![vlan_not_found] and [vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "vlan_label.key" => "vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "vlan_inner" => "string"
      }
      on_error => "vlan_inner_conversion_error"
    }

    mutate {
      replace => {
        "vlan_inner_label.value.string_value" => "%{vlan_inner}"
      }
      on_error => "vlan_inner_not_found"
    }

    if ![vlan_inner_not_found] and
      [vlan_inner_label][value][string_value] != "" {
      mutate {
        replace => {
          "vlan_inner_label.key" => "vlan_inner"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "vlan_inner_label"
        }
      }
    }

    # UDM > Security Result

    mutate {
      merge => {
        "token_security_result" => "file_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and  [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # NOTICE
  # - things which are odd or potentially bad
  # - https://docs.zeek.org/en/current/scripts/base/frameworks/notice/main.zeek.html

  else if [_path] == "notice" {
    # UDM > Metadata
    mutate {
      replace => {
        "token_metadata.description" => "%{msg}"
      }
      on_error => "msg_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "token_target.file.mime_type" => "%{file_mime_type}"
      }
      on_error => "file_mime_type_not_found"
    }

    grok {
      match => {
        "dst" => "%{IP:dst}"
      }
      overwrite => ["dst"]
      on_error => "ip_not_vaild"
    }

    if ![ip_not_vaild] {
      mutate {
        merge => {
          "token_target.ip" => "dst"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "resp_vulnerabiliti_details.cve_id" => "%{resp_vulnerable_host.cve}"
      }
      on_error => "resp_vulnerable_host_cve_not_found"
    }

    mutate {
      replace => {
        "resp_vulnerabiliti_details.cve_description" =>
        "%{resp_vulnerable_host.source}"
      }
      on_error => "resp_vulnerable_host_source_not_found"
    }

    mutate {
      convert => {
        "resp_vulnerable_host.criticality" => "string"
      }
      on_error => "resp_vulnerable_host_criticality_conversion_error"
    }

    mutate {
      replace => {
        "_" => "%{resp_vulnerable_host.criticality}"
      }
      on_error => "resp_vulnerable_host_criticality_not_found"
    }

    if ![resp_vulnerable_host_criticality_not_found] {
      if [resp_vulnerable_host][criticality] =~ "(?i)Critical"
      or [resp_vulnerable_host][criticality] == "4" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "CRITICAL"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)High"
      or [resp_vulnerable_host][criticality] == "3" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "HIGH"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Low"
      or [resp_vulnerable_host][criticality] == "1" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "LOW"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Medium"
      or [resp_vulnerable_host][criticality] == "2" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "MEDIUM"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Unknown_Severity"
      or [resp_vulnerable_host][criticality] == "0" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" =>
            "UNKNOWN_SEVERITY"
          }
        }
      }

      mutate {
        replace => {
          "resp_vulnerabiliti_details.severity_details" =>
          "%{resp_vulnerable_host.criticality}"
        }
      }
    }

    mutate {
      merge => {
        "token_target.asset.vulnerabilities" => "resp_vulnerabiliti_details"
      }
      on_error => "failed_to_merge_resp_vulnerabiliti_details"
    }

    mutate {
      replace => {
        "token_target.asset.hostname" => "%{resp_vulnerable_host.hostname}"
      }
      on_error => "resp_vulnerable_host_hostname_uid_not_found"
    }

    mutate {
      replace => {
        "token_target.asset.network_domain" =>
        "%{resp_vulnerable_host.machine_domain}"
      }
      on_error => "resp_vulnerable_host_machine_domain_not_found"
    }

    mutate {
      replace => {
        "token_target.asset.platform_software.platform_version" =>
        "%{resp_vulnerable_host.os_version}"
      }
      on_error => "resp_vulnerable_host_os_version_not_found"
    }

    # UDM > Security Result

    mutate {
      convert => {
        "severity.level" => "string"
      }
    }

    mutate {
      replace => {
        "severity_level.value" => "%{severity.level}"
      }
      on_error => "severity_level_not_found"
    }

    if ![severity_level_not_found] and [severity_level][value] != "" {

      mutate {
        replace => {
          "severity_level.key" => "severity_level"
        }
      }

      mutate {
        merge => {
          "token_security_result.detection_fields" => "severity_level"
        }
      }
    }

    if ![severity_level_not_found] {
      if [severity][level] in ["0", "1", "2"] {
        mutate{
          replace => {
            "token_security_result.severity" => "CRITICAL"
          }
        }
      }
      else if [severity][level] == "3" {
        mutate{
          replace => {
            "token_security_result.severity" => "ERROR"
          }
        }
      }
      else if [severity][level] == "4" {
        mutate{
          replace => {
            "token_security_result.severity" => "HIGH"
          }
        }
      }
      else if [severity][level] == "5" {
        mutate{
          replace => {
            "token_security_result.severity" => "LOW"
          }
        }
      }
      else if [severity][level] == "6" {
        mutate{
          replace => {
            "token_security_result.severity" => "INFORMATIONAL"
          }
        }
      }
      else {
        mutate{
          replace => {
            "token_security_result.severity" => "UNKNOWN_SEVERITY"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_security_result.severity_details" => "%{severity.name}"
      }
      on_error => "severity_name_not_found"
    }

    mutate {
      replace => {
        "token_security_result.description" => "%{note}"
      }
      on_error => "note_not_found"
    }

    mutate {
      replace => {
        "security_action" => "ALLOW"
      }
    }

    mutate {
      merge => {
        "token_security_result.action" => "security_action"
      }
    }

    mutate {
      convert => {
        "suppress_for" => "string"
      }
      on_error => "failed_to_convert_suppress_for"
    }

    mutate {
      replace => {
        "token_suppress_for.value" => "%{suppress_for}"
      }
      on_error => "suppress_for_not_set"
    }

    if ![suppress_for_not_set] and [suppress_for] != "" {
      mutate {
        replace => {
          "token_suppress_for.key" => "suppress_for"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_suppress_for"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "notice_security_result"
      }
    }

    for index, action in actions {
      if [index] == 0 {
        mutate {
          replace => {
            "notice_security_result.action_details" => "%{action}"
          }
          on_error => "action_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "action_security_result" => ""
          }
        }

        mutate {
          replace => {
            "action_security_result.action_details" => "%{action}"
          }
          on_error => "action_not_found"
        }

        mutate {
          merge => {
            "token_security_result" => "action_security_result"
          }
          on_error => "failed_to_merge_security_result"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "notice_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Network
    mutate {
      replace => {
        "proto" => "%{proto}"
      }
      on_error => "proto_not_set"
    }

    if ![proto_not_set] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }
    # UDM > Principal

    grok {
      match => {
        "src" => "%{IP:src}"
      }
      overwrite => ["src"]
      on_error => "ip_not_vaild"
    }

    if ![ip_not_vaild] {
      mutate {
        merge => {
          "token_principal.ip" => "src"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
    # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled

    mutate {
      replace => {
        "token_principal.hostname" => "%{src}"
      }
      on_error => "src_not_found"
    }

    if [src_not_found] {
      mutate {
        replace => {
          "token_principal.hostname" => "%{id.orig_h}"
        }
        on_error => "id_orig_h_not_founc"
      }
    }

    mutate {
      replace => {
        "orig_vulnerabiliti_details.cve_id" => "%{orig_vulnerable_host.cve}"
      }
      on_error => "orig_vulnerable_host_cve_not_found"
    }

    mutate {
      replace => {
        "orig_vulnerabiliti_details.cve_description" =>
        "%{orig_vulnerable_host.source}"
      }
      on_error => "orig_vulnerable_host_source_not_found"
    }

    mutate {
      convert => {
        "orig_vulnerable_host.criticality" => "string"
      }
      on_error => "orig_vulnerable_host_criticality_conversion_error"
    }

    mutate {
      replace => {
        "_" => "%{orig_vulnerable_host.criticality}"
      }
      on_error => "orig_vulnerable_host_criticality_not_found"
    }

    if ![orig_vulnerable_host_criticality_not_found] {
      if [orig_vulnerable_host][criticality] =~ "(?i)Critical"
      or [orig_vulnerable_host][criticality] == "4" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "CRITICAL"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)High"
      or [orig_vulnerable_host][criticality] == "3" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "HIGH"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Low"
      or [orig_vulnerable_host][criticality] == "1" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "LOW"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Medium"
      or [orig_vulnerable_host][criticality] == "2" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "MEDIUM"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Unknown_Severity"
      or [orig_vulnerable_host][criticality] == "0" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" =>
            "UNKNOWN_SEVERITY"
          }
        }
      }

      mutate {
        replace => {
          "orig_vulnerabiliti_details.severity_details" =>
          "%{orig_vulnerable_host.criticality}"
        }
      }
    }

    mutate {
      merge => {
        "token_principal.asset.vulnerabilities" => "orig_vulnerabiliti_details"
      }
      on_error => "failed_to_merge_orig_vulnerabiliti_details"
    }

    mutate {
      replace => {
        "token_principal.asset.hostname" => "%{orig_vulnerable_host.hostname}"
      }
      on_error => "orig_vulnerable_host_hostname_uid_not_found"
    }

    mutate {
      replace => {
        "token_principal.asset.network_domain" =>
        "%{orig_vulnerable_host.machine_domain}"
      }
      on_error => "orig_vulnerable_host_machine_domain_not_found"
    }

    mutate {
      replace => {
        "token_principal.asset.platform_software.platform_version" =>
        "%{orig_vulnerable_host.os_version}"
      }
      on_error => "orig_vulnerable_host_os_version_not_found"
    }

    # UDM > About

    mutate {
      replace => {
        "peer_descr_labels.value" => "%{peer_descr}"
      }
      on_error => "peer_descr_not_found"
    }
    if ![peer_descr_not_found] and [peer_descr] != "" {
      mutate {
        replace => {
          "peer_descr_labels.key" => "peer_descr"
        }
      }
      mutate {
        merge => {
          "token_about.labels" => "peer_descr_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_file_desc.value" => "%{file_desc}"
      }
      on_error => "file_desc_not_set"
    }

    if ![file_desc_not_set] and [file_desc] != "" {
      mutate {
        replace => {
          "token_file_desc.key" => "file_desc"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_file_desc"
        }
      }
    }

    mutate {
      replace => {
        "token_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }

    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "token_fuid.key" => "fuid"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_fuid"
        }
      }
    }

    mutate {
      merge => {
        "token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "token_sub.value" => "%{sub}"
      }
      on_error => "sub_not_set"
    }

    if ![sub_not_set] and [sub] != "" {
      mutate {
        replace => {
          "token_sub.key" => "sub"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_sub"
        }
      }
    }

    mutate {
      convert => {
        "p" => "integer"
      }
      on_error => "failed_to_convert_p"
    }

    mutate {
      rename => {
        "p" => "token_about.port"
      }
    }

    mutate {
      convert => {
        "n" => "string"
      }
      on_error => "failed_to_convert_n"
    }

    mutate {
      replace => {
        "token_n.value" => "%{n}"
      }
      on_error => "n_not_set"
    }

    if ![n_not_set] and [n] != "" {
      mutate {
        replace => {
          "token_n.key" => "n"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_n"
        }
      }
    }

    mutate {
      replace => {
        "token_about.location.country_or_region" =>
        "%{remote_location.country_code}: %{remote_location.region}"
      }
      on_error => "country_not_found"
    }

    if [country_not_found] {
      mutate {
        replace => {
          "token_about.location.country_or_region" =>
          "%{remote_location.country_code}"
        }
        on_error => "country_not_found"
      }

      mutate {
        replace => {
          "token_about.location.country_or_region" =>
          "%{remote_location.region}"
        }
        on_error => "region_not_found"
      }
    }

    mutate {
      replace => {
        "token_about.location.city" => "%{remote_location.city}"
      }
      on_error => "city_not_found"
    }

    mutate {
      convert => {
        "remote_location.latitude" => "float"
      }
      on_error => "latitude_not_converted"
    }

    mutate {
      rename => {
        "remote_location.latitude" =>
        "token_about.location.region_coordinates.latitude"
      }
      on_error => "remote_location_not_found"
    }

    mutate {
      convert => {
        "remote_location.longitude" => "float"
      }
      on_error => "longitude_not_converted"
    }

    mutate {
      rename => {
        "remote_location.longitude" =>
        "token_about.location.region_coordinates.longitude"
      }
      on_error => "remote_location_not_found"
    }

    mutate {
      rename => {
        "token_about" => "notice_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "notice_about"
      }
      on_error => "failed_to_merge_token_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "orig_vulnerable_host.host_uid" => "string"
      }
      on_error => "orig_vulnerable_host_uid_conversion_error"
    }

    mutate {
      replace => {
        "orig_vulnerable_host_uid_label.value.string_value" =>
        "%{orig_vulnerable_host.host_uid}"
      }
      on_error => "orig_vulnerable_host_uid_not_found"
    }

    if ![orig_vulnerable_host_uid_not_found] and
      [orig_vulnerable_host_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "orig_vulnerable_host_uid_label.key" => "orig_vulnerable_host_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "orig_vulnerable_host_uid_label"
        }
      }
    }

    mutate {
      convert => {
        "resp_vulnerable_host.host_uid" => "string"
      }
      on_error => "resp_vulnerable_host_uid_conversion_error"
    }

    mutate {
      replace => {
        "resp_vulnerable_host_uid_label.value.string_value" =>
        "%{resp_vulnerable_host.host_uid}"
      }
      on_error => "resp_vulnerable_host_uid_not_found"
    }

    if ![resp_vulnerable_host_uid_not_found] and
      [resp_vulnerable_host_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "resp_vulnerable_host_uid_label.key" => "resp_vulnerable_host_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "resp_vulnerable_host_uid_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Suricata

  else if [_path] == "suricata_corelight" {

    # UDM > Metadata

    mutate {
      replace => {
        "token_metadata.product_name" => "Suricata"
      }
    }

    # UDM > Intermediary

    mutate {
      convert => {
        "id.vlan" => "string"
      }
      on_error => "failed_to_convert_id_vlan"
    }

    mutate {
      replace => {
        "token_id_vlan.value" => "%{id.vlan}"
      }
      on_error => "id_vlan_not_set"
    }

    if ![id_vlan_not_set] and [id][vlan] != "" {
      mutate {
        replace => {
          "token_id_vlan.key" => "id_vlan"
        }
      }

      mutate {
        merge => {
          "token_intermediary.labels" => "token_id_vlan"
        }
      }
    }

    mutate {
      convert => {
        "id.vlan_inner" => "string"
      }
      on_error => "failed_to_convert_id_vlan_inner"
    }

    mutate {
      replace => {
        "token_id_vlan_inner.value" => "%{id.vlan_inner}"
      }
      on_error => "id_vlan_inner_not_set"
    }

    if ![id_vlan_inner_not_set] and [id][vlan_inner] != "" {
      mutate {
        replace => {
          "token_id_vlan_inner.key" => "id_vlan_inner"
        }
      }

      mutate {
        merge => {
          "token_intermediary.labels" => "token_id_vlan_inner"
        }
      }
    }

    # UDM > About

    mutate {
      convert => {
        "icmp_type" => "string"
      }
      on_error => "failed_to_convert_icmp_type"
    }

    mutate {
      replace => {
        "token_icmp_type.value" => "%{icmp_type}"
      }
      on_error => "icmp_type_not_set"
    }

    if ![icmp_type_not_set] and [icmp_type] != "" {
      mutate {
        replace => {
          "token_icmp_type.key" => "icmp_type"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_icmp_type"
        }
      }
    }

    mutate {
      merge => {
        "token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "icmp_code" => "string"
      }
      on_error => "failed_to_convert_icmp_code"
    }

    mutate {
      replace => {
        "token_icmp_code.value" => "%{icmp_code}"
      }
      on_error => "icmp_code_not_set"
    }

    if ![icmp_code_not_set] and [icmp_code] != "" {
      mutate {
        replace => {
          "token_icmp_code.key" => "icmp_code"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_icmp_code"
        }
      }
    }

    mutate {
      convert => {
        "tx_id" => "string"
      }
      on_error => "failed_to_convert_tx_id"
    }

    mutate {
      replace => {
        "token_tx_id.value" => "%{tx_id}"
      }
      on_error => "tx_id_not_set"
    }

    if ![tx_id_not_set] and [tx_id] != "" {
      mutate {
        replace => {
          "token_tx_id.key" => "tx_id"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_tx_id"
        }
      }
    }

    mutate {
      convert => {
        "pcap_cnt" => "string"
      }
      on_error => "failed_to_convert_pcap_cnt"
    }

    mutate {
      replace => {
        "token_pcap_cnt.value" => "%{pcap_cnt}"
      }
      on_error => "pcap_cnt_not_set"
    }

    if ![pcap_cnt_not_set] and [pcap_cnt] != "" {
      mutate {
        replace => {
          "token_pcap_cnt.key" => "pcap_cnt"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_pcap_cnt"
        }
      }
    }

    mutate {
      replace => {
        "token_payload.value" => "%{payload}"
      }
      on_error => "payload_not_set"
    }

    if ![payload_not_set] and [payload] != "" {
      mutate {
        replace => {
          "token_payload.key" => "payload"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_payload"
        }
      }
    }

    mutate {
      replace => {
        "token_packet.value" => "%{packet}"
      }
      on_error => "packet_not_set"
    }

    if ![packet_not_set] and [packet] != "" {
      mutate {
        replace => {
          "token_packet.key" => "packet"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_packet"
        }
      }
    }

    base64 {
      source => "payload"
      target => "payload_decoded"
      encoding => "Standard"
      on_error => "payload_decode_failure"
    }
    mutate {
      replace => {
        "token_payload_dec.value" => "%{payload_decoded}"
      }
      on_error => "payload_not_set"
    }

    if ![payload_not_set] and [payload] != "" {
      mutate {
        replace => {
          "token_payload_dec.key" => "payload_decoded"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_payload_dec"
        }
      }
    }

    base64 {
      source => "packet"
      target => "packet_decoded"
      encoding => "Standard"
      on_error => "packet_decode_failure"
    }
    mutate {
      replace => {
        "token_packet_dec.value" => "%{packet_decoded}"
      }
      on_error => "packet_not_set"
    }

    if ![packet_not_set] and [packet] != "" {
      mutate {
        replace => {
          "token_packet_dec.key" => "packet_decoded"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "token_packet_dec"
        }
      }
    }

    mutate {
      replace => {
        "orig_host_uid.value" => "%{orig_vulnerable_host.host_uid}"
      }
      on_error => "orig_vulner_host_uid_not_found"
    }

    if ![orig_vulner_host_uid_not_found] and [orig_host_uid][value] != "" {
      mutate {
        replace => {
          "orig_host_uid.key" => "orig_vulnerable_host_uid"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "orig_host_uid"
        }
      }
    }

    mutate {
      replace => {
        "resp_host_uid.value" => "%{resp_vulnerable_host.host_uid}"
      }
      on_error => "resp_vulner_host_uid_not_found"
    }

    if ![resp_vulner_host_uid_not_found] and [resp_host_uid][value] != "" {
      mutate {
        replace => {
          "resp_host_uid.key" => "resp_vulnerable_host_uid"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "resp_host_uid"
        }
      }
    }

    mutate {
      replace => {
        "suricata_service.value" => "%{service}"
      }
      on_error => "suricata_service_not_set"
    }

    if ![suricata_service_not_set] and [suricata_service][value] != "" {
      mutate {
        replace => {
          "suricata_service.key" => "service"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "suricata_service"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "suricata_about"
      }
    }

    mutate {
      merge => {
        "token_about" => "suricata_about"
      }
      on_error => "failed_to_merge_about"
    }

    mutate {
      replace => {
        "token_metadata.product_log_id" => "%{suri_id}"
      }
      on_error => "suri_id_not_found"
    }

    mutate {
      replace => {
        "token_security_result.action_details" => "%{alert.action}"
      }
      on_error => "action_action_not_found"
    }

    mutate {
      convert => {
        "alert.gid" => "string"
      }
      on_error => "failed_to_convert_alert_gid"
    }

    mutate {
      replace => {
        "token_alert_gid.value" => "%{alert.gid}"
      }
      on_error => "alert_gid_not_set"
    }

    if ![alert_gid_not_set] and [alert][gid] != "" {
      mutate {
        replace => {
          "token_alert_gid.key" => "alert_gid"
        }
      }

      mutate {
        merge => {
          "token_security_result.detection_fields" => "token_alert_gid"
        }
      }
    }

    mutate {
      convert => {
        "alert.rev" => "string"
      }
      on_error => "failed_to_convert_alert_rev"
    }

    mutate {
      replace => {
        "token_alert_rev.value" => "%{alert.rev}"
      }
      on_error => "alert_rev_not_set"
    }

    if ![alert_rev_not_set] and [alert][rev] != "" {
      mutate {
        replace => {
          "token_alert_rev.key" => "alert_rev"
        }
      }

      mutate {
        merge => {
          "token_security_result.detection_fields" => "token_alert_rev"
        }
      }
    }

    mutate {
      convert => {
        "alert.signature_id" => "string"
      }
      on_error => "failed_to_convert_alert_signature_id"
    }

    mutate {
      replace => {
        "token_security_result.rule_id" => "%{alert.signature_id}"
      }
      on_error => "alert_signature_id_not_found"
    }

    mutate {
      replace => {
        "token_security_result.summary" => "%{alert.signature}"
      }
      on_error => "alert_signature_not_found"
    }

    mutate {
      replace => {
        "token_security_result.rule_name" => "%{alert.signature}"
      }
      on_error => "alert_signature_not_found"
    }

    mutate {
      merge => {
        "token_security_result.category_details" => "alert.category"
      }
      on_error => "alert_category_not_found"
    }

    mutate {
      convert => {
        "alert.severity" => "string"
      }
      on_error => "failed_to_convert_severity"
    }

    mutate {
      replace => {
        "alert.severity" => "%{alert.severity}"
      }
      on_error => "severity_not_found"
    }

    if ![severity_not_found] {
      if [alert][severity] == "1" {
        mutate{
          replace => {
            "token_security_result.severity" => "CRITICAL"
          }
        }
      }
      else if [alert][severity] == "2" {
        mutate{
          replace => {
            "token_security_result.severity" => "HIGH"
          }
        }
      }
      else if [alert][severity] == "3" {
        mutate{
          replace => {
            "token_security_result.severity" => "MEDIUM"
          }
        }
      }
      else if [alert][severity] == "4" {
        mutate{
          replace => {
            "token_security_result.severity" => "LOW"
          }
        }
      }

      mutate {
        convert => {
          "alert.severity" => "float"
        }
        on_error => "severity_not_found"
      }

      mutate {
        rename => {
          "alert.severity" => "token_alert_severity.value.number_value"
        }
        on_error => "risk_score_not_found"
      }

      mutate {
        replace => {
          "token_alert_severity.key" => "alert_severity"
        }
      }

      mutate {
        merge => {
          "token_additional.fields" => "token_alert_severity"
        }
        on_error => "alert_severity_not_found"
      }
    }
    mutate {
      replace => {
        "token_security_result.severity_details" => "%{alert.severity}"
      }
      on_error => "alert_severity_not_found"
    }

    grok {
      match => {
        "alert.rule" =>
        "signature_severity (?P<signature_severity>Critical|Major|Minor|Informational)"
      }
      overwrite => ["signature_severity"]
      on_error => "signature_severity_not_found"
    }

    if ![signature_severity_not_found] {

      if [signature_severity] == "Critical" {
        mutate{
          replace => {
            "token_security_result.severity" => "CRITICAL"
          }
        }
      }else if [signature_severity] == "Major" {
        mutate{
          replace => {
            "token_security_result.severity" => "MEDIUM"
          }
        }
      }
      else if [signature_severity] == "Minor" {
        mutate{
          replace => {
            "token_security_result.severity" => "LOW"
          }
        }
      }
      else if [signature_severity] == "Informational" {
        mutate{
          replace => {
            "token_security_result.severity" => "INFORMATIONAL"
          }
        }
      }

      mutate {
        replace => {
          "token_security_result.severity_details" => "%{signature_severity}"
        }
      }
    }

    for alertmetadatainfo in alert.metadata {
      mutate {
        replace => {
          "temp_array" => ""
        }
      }
      mutate {
          replace => {
            "token_alert_metadata_info" => ""
          }
        }
      if [alertmetadatainfo] =~ ":" {
        mutate {
          split => {
            source => "alertmetadatainfo"
            separator => ":"
            target => "temp_array"
          }
        }

        mutate {
          replace => {
            "token_alert_metadata_info.value" => "%{temp_array.1}"
          }
          on_error => "alert_metadata_info_not_set"
        }

        if ![alert_metadata_info_not_set] and
        [token_alert_metadata_info][value] != "" {
          mutate {
            replace => {
              "token_alert_metadata_info.key" => "%{temp_array.0}"
            }
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_alert_metadata_info.value" => "%{alertmetadatainfo}"
          }
          on_error => "alert_metadata_info_not_set"
        }

        if ![alert_metadata_info_not_set] and
        [token_alert_metadata_info][value] != "" {
          mutate {
            replace => {
              "token_alert_metadata_info.key" => "alert_metadata"
            }
          }
        }
      }
      if ![alert_metadata_info_not_set] and
      [token_alert_metadata_info][value] != "" {
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "token_alert_metadata_info"
          }
        }
      }
    }

    for metadatainfo in metadata {
      mutate {
        replace => {
          "token_metadata_info" => ""
        }
      }

      mutate {
        replace => {
          "token_metadata_info.value" => "%{metadatainfo}"
        }
        on_error => "metadata_info_not_set"
      }

      if ![metadata_info_not_set] and [metadatainfo] != "" {
        mutate {
          replace => {
            "token_metadata_info.key" => "metadata"
          }
        }

        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "token_metadata_info"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_security_result.description" => "%{alert.rule}"
      }
      on_error => "alert_rule_not_found"
    }

    grok {
      match => {
        "alert.rule" => [
          '%{GREEDYDATA:_}content:\\"%{GREEDYDATA:rule_content}\\"'
        ]
      }
      overwrite => ["_"]
      on_error => "alert_rule_content_not_found"
    }

    grok {
      match => {
        "alert.rule" => [
          '%{GREEDYDATA:_}metadata:%{DATA:rule_metadata};'
        ]
      }
      on_error => "alert_rule_metadata_not_found"
      overwrite => ["_"]
    }

    if ![alert_rule_metadata_not_found] {
      mutate {
        gsub => [rule_metadata, ", ", "#"]
      }

      kv {
        source => "rule_metadata"
        field_split => "#"
        value_split => " "
        on_error => "rule_metadata_not_found"
      }

      mutate {
        convert => {
          "attack_target" => "string"
        }
        on_error => "alert_rule_attack_target_conversion_error"
      }

      mutate {
        replace => {
          "alert_rule_attack_target_label.value" => "%{attack_target}"
        }
        on_error => "alert_rule_attack_target_not_found"
      }

      if ![alert_rule_attack_target_not_found] and
        [alert_rule_attack_target_label][value] != "" {
        mutate {
          replace => {
            "alert_rule_attack_target_label.key" => "alert_rule_attack_target"
          }
        }
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "alert_rule_attack_target_label"
          }
          remove_field => ["alert_rule_attack_target_label"]
        }
      }

      mutate {
        convert => {
          "created_at" => "string"
        }
        on_error => "alert_rule_created_at_conversion_error"
      }

      mutate {
        replace => {
          "alert_rule_created_at_label.value" => "%{created_at}"
        }
        on_error => "alert_rule_created_at_not_found"
      }

      if ![alert_rule_created_at_not_found] and
        [alert_rule_created_at_label][value] != "" {
        mutate {
          replace => {
            "alert_rule_created_at_label.key" => "alert_rule_created_at"
          }
        }
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "alert_rule_created_at_label"
          }
          remove_field => ["alert_rule_created_at_label"]
        }
      }

      mutate {
        convert => {
          "deployment" => "string"
        }
        on_error => "alert_rule_deployment_conversion_error"
      }

      mutate {
        replace => {
          "alert_rule_deployment_label.value" => "%{deployment}"
        }
        on_error => "alert_rule_deployment_not_found"
      }

      if ![alert_rule_deployment_not_found] and
        [alert_rule_deployment_label][value] != "" {
        mutate {
          replace => {
            "alert_rule_deployment_label.key" => "alert_rule_deployment"
          }
        }
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "alert_rule_deployment_label"
          }
          remove_field => ["alert_rule_deployment_label"]
        }
      }

      mutate {
        convert => {
          "performance_impact" => "string"
        }
        on_error => "alert_rule_performance_impact_conversion_error"
      }

      mutate {
        replace => {
          "alert_rule_performance_impact_label.value" =>
          "%{performance_impact}"
        }
        on_error => "alert_rule_performance_impact_not_found"
      }

      if ![alert_rule_performance_impact_not_found] and
        [alert_rule_performance_impact_label][value] != "" {
        mutate {
          replace => {
            "alert_rule_performance_impact_label.key" =>
            "alert_rule_performance_impact"
          }
        }
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "alert_rule_performance_impact_label"
          }
          remove_field => ["alert_rule_performance_impact_label"]
        }
      }

      mutate {
        convert => {
          "updated_at" => "string"
        }
        on_error => "alert_rule_updated_at_conversion_error"
      }

      mutate {
        replace => {
          "alert_rule_updated_at_label.value" => "%{updated_at}"
        }
        on_error => "alert_rule_updated_at_not_found"
      }

      if ![alert_rule_updated_at_not_found] and
        [alert_rule_updated_at_label][value] != "" {
        mutate {
          replace => {
            "alert_rule_updated_at_label.key" => "alert_rule_updated_at"
          }
        }
        mutate {
          merge => {
            "token_security_result.detection_fields" =>
            "alert_rule_updated_at_label"
          }
          remove_field => ["alert_rule_updated_at_label"]
        }
      }
    }

    grok {
      match => {
        "alert.rule" => [
          '%{GREEDYDATA:_}classtype:%{DATA:rule_classtype};'
        ]
      }
      on_error => "alert_rule_classtype_not_found"
      overwrite => ["_"]
    }

    grok {
      match => {
        "alert.rule" => [
          '%{GREEDYDATA:_}reference:url,%{DATA:reference_url};'
        ]
      }
      on_error => "alert_rule_reference_url_not_found"
      overwrite => ["_"]
    }

    mutate {
      convert => {
        "rule_content" => "string"
      }
      on_error => "alert_rule_content_conversion_error"
    }

    mutate {
      replace => {
        "alert_rule_content_label.value" => "%{rule_content}"
      }
      on_error => "alert_rule_content_not_found"
    }

    if ![alert_rule_content_not_found] and
      [alert_rule_content_label][value] != "" {
      mutate {
        replace => {
          "alert_rule_content_label.key" => "alert_rule_content"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" => "alert_rule_content_label"
        }
        remove_field => ["alert_rule_content_label"]
      }
    }

    mutate {
      convert => {
        "rule_classtype" => "string"
      }
      on_error => "alert_rule_classtype_conversion_error"
    }

    mutate {
      replace => {
        "alert_rule_classtype_label.value" => "%{rule_classtype}"
      }
      on_error => "alert_rule_classtype_not_found"
    }

    if ![alert_rule_classtype_not_found] and
      [alert_rule_classtype_label][value] != "" {
      mutate {
        replace => {
          "alert_rule_classtype_label.key" => "alert_rule_classtype"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" =>
          "alert_rule_classtype_label"
        }
        remove_field => ["alert_rule_classtype_label"]
      }
    }

    mutate {
      convert => {
        "reference_url" => "string"
      }
      on_error => "alert_rule_reference_url_conversion_error"
    }

    mutate {
      replace => {
        "alert_rule_reference_url_label.value" => "%{reference_url}"
      }
      on_error => "alert_rule_reference_url_not_found"
    }

    if ![alert_rule_reference_url_not_found] and
      [alert_rule_reference_url_label][value] != "" {
      mutate {
        replace => {
          "alert_rule_reference_url_label.key" => "alert_rule_reference_url"
        }
      }
      mutate {
        merge => {
          "token_security_result.detection_fields" =>
          "alert_rule_reference_url_label"
        }
        remove_field => ["alert_rule_reference_url_label"]
      }
    }

    for temp_reference in alert.references {
      mutate {
        convert => {
          "temp_reference" => "string"
        }
        on_error => "_"
      }

      mutate {
        replace => {
          "token_alert_ref.value" => "%{temp_reference}"
        }
        on_error => "alert_reference_not_set"
      }

      if ![alert_reference_not_set] and [token_alert_ref][value] != "" {
        mutate {
          replace => {
            "token_alert_ref.key" => "alert_references"
          }
        }

        mutate {
          merge => {
            "token_security_result.detection_fields" => "token_alert_ref"
          }
          remove_field => ["token_alert_ref"]
        }
      }
    }

    mutate {
      convert => {
        "payload_printable" => "string"
      }
      on_error => "_"
    }

    mutate {
      replace => {
        "token_payload_printable.value" => "%{payload_printable}"
      }
      on_error => "payload_printable_not_set"
    }

    if ![payload_printable_not_set] and [token_payload_printable][value] != "" {
      mutate {
        replace => {
          "token_payload_printable.key" => "payload_printable"
        }
      }

      mutate {
        merge => {
          "token_security_result.detection_fields" => "token_payload_printable"
        }
        remove_field => ["token_payload_printable"]
      }
    }

    for reference in references {
      mutate {
        convert => {
          "reference" => "string"
        }
        on_error => "_"
      }

      mutate {
        replace => {
          "token_ref.value" => "%{reference}"
        }
        on_error => "reference_not_set"
      }

      if ![reference_not_set] and [token_ref][value] != "" {
        mutate {
          replace => {
            "token_ref.key" => "references"
          }
        }

        mutate {
          merge => {
            "token_security_result.detection_fields" => "token_ref"
          }
          remove_field => ["token_ref"]
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "suricata_security_result"
      }
    }

    mutate {
      merge => {
        "token_security_result" => "suricata_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Network

    mutate {
      replace => {
        "service" => "%{service}"
      }
      on_error => "service_not_set"
    }

    if ![service_not_set] {
      mutate {
        uppercase => ["service"]
        on_error => "failed_to_upper_service"
      }

      if [service] in ["AFP", "AMQP", "APPC", "ATOM", "BEEP", "BIT_TORRENT",
      "BITCOIN", "CFDP", "COAP", "DCERPC", "DDS", "DEVICE_NET", "DHCP",
      "DNS", "E_DONKEY", "ENRP", "FAST_TRACK", "FINGER", "FREENET", "FTAM",
      "GOPHER", "H323", "HL7", "HTTP", "HTTPS", "IRCP", "KADEMLIA", "KRB5",
      "LDAP", "LPD", "MIME", "MODBUS", "MQTT", "NETCONF", "NFS", "NIS",
      "NNTP", "NTCIP", "NTP", "OSCAR", "PNRP", "QUIC", "RDP", "RELP", "RIP",
      "RLOGIN", "RPC", "RTMP", "RTP", "RTPS", "RTSP", "SAP", "SDP", "SIP",
      "SLP", "SMB", "SMTP", "SNTP", "SSH", "SSMS", "STYX", "TCAP", "TDS",
      "TOR", "TSP", "VTP", "WEB_DAV", "WHOIS", "X400", "X500", "XMPP"] {
        mutate {
          replace => {
            "token_network.application_protocol" => "%{service}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.application_protocol" =>
            "UNKNOWN_APPLICATION_PROTOCOL"
          }
        }
      }
    }

    mutate {
      convert => {
        "flow_id" => "string"
      }
      on_error => "failed_to_convert_flow_id"
    }

    mutate {
      replace => {
        "token_network.session_id" => "%{flow_id}"
      }
      on_error => "flow_id_not_found"
    }

    mutate {
      replace => {
        "token_network.community_id" => "%{community_id}"
      }
      on_error => "community_id_not_found"
    }

    # UDM > IDM

    mutate {
      replace => {
        "event.idm.is_significant" => "true"
        "event.idm.is_alert" => "true"
      }
    }

    mutate {
      convert => {
        "event.idm.is_significant" => "boolean"
        "event.idm.is_alert" => "boolean"
      }
    }

    # UDM > Extentions

    mutate {
      replace => {
        "token_orig_cve.cve_id" => "%{orig_cve}"
      }
      on_error => "orig_cve_not_found"
    }

    mutate {
      replace => {
        "token_resp_cve.cve_id" => "%{resp_cve}"
      }
      on_error => "resp_cve_not_found"
    }

    mutate {
      merge => {
        "token_extensions.vulns.vulnerabilities" => "token_orig_cve"
      }
      on_error => "failed_to_merge_orig_cve"
    }

    mutate {
      merge => {
        "token_extensions.vulns.vulnerabilities" => "token_resp_cve"
      }
      on_error => "failed_to_merge_resp_cve"
    }

    mutate {
      rename => {
        "token_intermediary" => "suricata_intermediary"
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "suricata_intermediary"
      }
      on_error => "failed_to_merge_intermediary"
    }

    # UDM > Principal

    mutate {
      replace => {
        "orig_vulnerabiliti_details.cve_id" => "%{orig_vulnerable_host.cve}"
      }
      on_error => "orig_vulnerable_host_cve_not_found"
    }

    mutate {
      replace => {
        "orig_vulnerabiliti_details.cve_description" =>
        "%{orig_vulnerable_host.source}"
      }
      on_error => "orig_vulnerable_host_source_not_found"
    }

    mutate {
      replace => {
        "_" => "%{orig_vulnerable_host.criticality}"
      }
      on_error => "orig_vulnerable_host_criticality_not_found"
    }

    if ![orig_vulnerable_host_criticality_not_found] {
      if [orig_vulnerable_host][criticality] =~ "(?i)Critical"
      or [orig_vulnerable_host][criticality] == "4" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "CRITICAL"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)High"
      or [orig_vulnerable_host][criticality] == "3" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "HIGH"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Low"
      or [orig_vulnerable_host][criticality] == "1" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "LOW"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Medium"
      or [orig_vulnerable_host][criticality] == "2" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" => "MEDIUM"
          }
        }
      }else if [orig_vulnerable_host][criticality] =~ "(?i)Unknown_Severity"
      or [orig_vulnerable_host][criticality] == "0" {
        mutate {
          replace => {
            "orig_vulnerabiliti_details.severity" =>
            "UNKNOWN_SEVERITY"
          }
        }
      }

      mutate {
        replace => {
          "orig_vulnerabiliti_details.severity_details" =>
          "%{orig_vulnerable_host.criticality}"
        }
      }
    }

    mutate {
      merge => {
        "token_principal.asset.vulnerabilities" => "orig_vulnerabiliti_details"
      }
      on_error => "failed_to_merge_orig_vulnerabiliti_details"
    }

    mutate {
      replace => {
        "token_principal.asset.hostname" => "%{orig_vulnerable_host.hostname}"
      }
      on_error => "orig_vulnerable_host_hostname_uid_not_found"
    }

    mutate {
      replace => {
        "token_principal.asset.network_domain" =>
        "%{orig_vulnerable_host.machine_domain}"
      }
      on_error => "orig_vulnerable_host_machine_domain_not_found"
    }

    mutate {
      replace => {
        "token_principal.asset.platform_software.platform_version" =>
        "%{orig_vulnerable_host.os_version}"
      }
      on_error => "orig_vulnerable_host_os_version_not_found"
    }

    # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
    # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled

    mutate {
      replace => {
        "token_principal.hostname" => "%{id.orig_h}"
      }
      on_error => "id_orig_h_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "resp_vulnerabiliti_details.cve_id" => "%{resp_vulnerable_host.cve}"
      }
      on_error => "resp_vulnerable_host_cve_not_found"
    }

    mutate {
      replace => {
        "resp_vulnerabiliti_details.cve_description" =>
        "%{resp_vulnerable_host.source}"
      }
      on_error => "resp_vulnerable_host_source_not_found"
    }

    mutate {
      replace => {
        "_" => "%{resp_vulnerable_host.criticality}"
      }
      on_error => "resp_vulnerable_host_criticality_not_found"
    }

    if ![resp_vulnerable_host_criticality_not_found] {
      if [resp_vulnerable_host][criticality] =~ "(?i)Critical"
      or [resp_vulnerable_host][criticality] == "4" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "CRITICAL"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)High"
      or [resp_vulnerable_host][criticality] == "3" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "HIGH"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Low"
      or [resp_vulnerable_host][criticality] == "1" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "LOW"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Medium"
      or [resp_vulnerable_host][criticality] == "2" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" => "MEDIUM"
          }
        }
      }else if [resp_vulnerable_host][criticality] =~ "(?i)Unknown_Severity"
      or [resp_vulnerable_host][criticality] == "0" {
        mutate {
          replace => {
            "resp_vulnerabiliti_details.severity" =>
            "UNKNOWN_SEVERITY"
          }
        }
      }

      mutate {
        replace => {
          "resp_vulnerabiliti_details.severity_details" =>
          "%{resp_vulnerable_host.criticality}"
        }
      }
    }

    mutate {
      merge => {
        "token_target.asset.vulnerabilities" => "resp_vulnerabiliti_details"
      }
      on_error => "failed_to_merge_resp_vulnerabiliti_details"
    }

    mutate {
      replace => {
        "token_target.asset.hostname" => "%{resp_vulnerable_host.hostname}"
      }
      on_error => "resp_vulnerable_host_hostname_uid_not_found"
    }

    mutate {
      replace => {
        "token_target.asset.network_domain" =>
        "%{resp_vulnerable_host.machine_domain}"
      }
      on_error => "resp_vulnerable_host_machine_domain_not_found"
    }

    mutate {
      replace => {
        "token_target.asset.platform_software.platform_version" =>
        "%{resp_vulnerable_host.os_version}"
      }
      on_error => "resp_vulnerable_host_os_version_not_found"
    }

    # UDM > additional
    for mt in meta {
      mutate {
        convert => {
          "mt" => "string"
        }
        on_error => "failed_to_convert_mt_to_string"
      }

      mutate {
        replace => {
          "meta_value.string_value" => "%{mt}"
        }
      }

      mutate {
        merge => {
          "meta_label.value.list_value.values" => "meta_value"
        }
        on_error => "failed_to_merge_meta_label"
        remove_field => ["meta_value"]
      }
    }

    mutate {
      merge => {
        "temp_arr" => "meta_label"
      }
      on_error => "meta_label_not_exist"
    }

    if ![meta_label_not_exist] {
      mutate {
        replace => {
          "meta_label.key" => "meta"
        }
      }

      mutate {
        merge => {
          "token_additional.fields" => "meta_label"
        }
        remove_field => ["meta_label"]
      }
    }

    # Check if required udm validation fields for SCAN_NETWORK exist.
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "SCAN_NETWORK"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # INTEL
  # - Provides information about IOC and Entity
  # - https://docs.zeek.org/en/current/scripts/base/files/pe/main.zeek.html

  else if [_path] == "intel" {

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "indicator_type" => "%{seen.indicator_type}"
      }
      on_error => "indicator_type_not_found"
    }

    if ![indicator_type_not_found] {
      if [indicator_type] in ["Intel::SUBNET", "Intel::ADDR"] {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "IP_ADDRESS"
          }
        }
      }
      else if [indicator_type] in ["Intel::SOFTWARE", "Intel::CERT_HASH",
      "Intel::PUBKEY_HASH"] {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "RESOURCE"
          }
        }
      }
      else if [indicator_type] == "Intel::URL" {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "URL"
          }
        }
      }
      else if [indicator_type] in ["Intel::EMAIL", "Intel::USER_NAME"] {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "USER"
          }
        }
      }
      else if [indicator_type] == "Intel::DOMAIN" {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "DOMAIN_NAME"
          }
        }
      }
      else if [indicator_type] in ["Intel::FILE_HASH", "Intel::FILE_NAME"] {
        mutate {
          replace => {
            "entity_metadata.entity_type" => "FILE"
          }
        }
      }
      else {
        # Setting Entity Type as "RESOURCE" for unsupported indicator type.
        mutate {
          replace => {
            "entity_metadata.entity_type" => "RESOURCE"
          }
        }
      }
    }

    mutate {
      replace => {
        "required_field_not_found" => "false"
      }
    }

    mutate {
      replace => {
        "token_senn_where.value" => "%{seen.where}"
      }
      on_error => "seen_where_not_found"
    }

    if ![seen_where_not_found] and [seen][where] != "" {
      mutate {
        replace => {
          "token_senn_where.key" => "seen_where"
        }
      }

      mutate {
        merge => {
          "entity_metadata.source_labels" => "token_senn_where"
        }
      }
    }

    mutate {
      replace => {
        "token_ioc.feed_name" => "%{seen.where}"
      }
      on_error => "seen_where_not_found"
    }

    if [seen_where_not_found] {
      mutate {
        replace => {
          "required_field_not_found" => "true"
        }
      }
    }

    for source in sources {
      mutate {
        replace => {
          "token_source" => ""
        }
      }

      mutate {
        replace => {
          "token_source.value" => "%{source}"
        }
        on_error => "source_not_found"
      }

      if ![source_not_found] and [source] != "" {
        mutate {
          replace => {
            "token_source.key" => "source"
          }
        }

        mutate {
          merge => {
            "entity_metadata.source_labels" => "token_source"
          }
        }
      }
    }

    mutate {
      replace => {
        "seen_indicator" => "%{seen.indicator}"
      }
      on_error => "seen_indicator_not_found"
    }
    if [seen_indicator_not_found] {
      mutate {
        replace => {
          "required_field_not_found" => "true"
        }
      }
    }

    # UDM > Entity > Entity
    if ![indicator_type_not_found] {
      if [entity_metadata][entity_type] == "IP_ADDRESS" {
        grok {
          match => {
            "seen.indicator" => "%{IP:seen_indicator}"
          }
          overwrite => ["seen_indicator"]
          on_error => "ip_not_vaild"
        }

        if ![ip_not_vaild] {
          mutate {
            merge => {
              "token_entity.ip" => "seen_indicator"
            }
          }

          mutate {
            convert => {
              "seen_indicator" => "bytes"
            }
            on_error => "failed_to_convert_seen_indicator"
          }

          mutate {
            rename => {
              "seen_indicator" => "token_ioc.ip_and_ports.ip_address"
            }
            on_error => "seen_indicator_not_found"
          }
        }
        else {
          mutate {
            replace => {
              "required_field_not_found" => "true"
            }
          }
        }
      }
      else if [entity_metadata][entity_type] == "URL" {
        mutate {
          replace => {
            "token_entity.url" => "%{seen.indicator}"
          }
          on_error => "seen_indicator_not_found"
        }
      }
      else if [entity_metadata][entity_type] == "DOMAIN_NAME" {
        mutate {
          replace => {
            "token_entity.domain.name" => "%{seen.indicator}"
          }
          on_error => "seen_indicator_not_found"
        }

        # Hostname is mandetory field for entity type as "DOMAIN_NAME"
        mutate {
          replace => {
            "token_entity.hostname" => "%{seen.indicator}"
          }
          on_error => "seen_indicator_not_found"
        }
      }
      else if [entity_metadata][entity_type] == "USER" {
        grok {
          match => {
            "seen.indicator" => "%{EMAILADDRESS:seen_indicator}"
          }
          overwrite => ["seen_indicator"]
          on_error => "email_not_vaild"
        }

        if ![email_not_vaild] {
          mutate {
            merge => {
              "token_entity.user.email_addresses" => "seen_indicator"
            }
          }
        }
        else {
          mutate {
            replace => {
              "required_field_not_found" => "true"
            }
          }
        }
      }
      else if [entity_metadata][entity_type] == "FILE" {
        mutate {
          merge => {
            "token_entity.file.names" => "seen.indicator"
          }
          on_error => "seen_indicator_not_found"
        }
      }
      else if [entity_metadata][entity_type] == "RESOURCE" {
        mutate {
          replace => {
            "token_entity.resource.name" => "%{seen.indicator}"
          }
          on_error => "seen_indicator_not_found"
        }

        # For entity type validation
        mutate {
          replace => {
            "token_entity.resource.resource_type" => "MUTEX"
          }
        }

        mutate {
          replace => {
            "token_entity.resource.resource_subtype" =>
            "%{seen.indicator_type}"
          }
          on_error => "seen_indicator_type_not_found"
        }
      }

      if [entity_metadata][entity_type] != "IP_ADDRESS" {
        mutate {
          replace => {
            "token_ioc.domain_and_ports.domain" => "%{seen.indicator}"
          }
          on_error => "seen_indicator_not_found"
        }
      }
    }

     mutate {
      replace => {
        "temp_indicator_type.value" => "%{seen.indicator_type}"
      }
      on_error => "indicator_type_not_found"
    }

    if ![indicator_type_not_found] and [temp_indicator_type][value] != "" {
      mutate {
        replace => {
          "temp_indicator_type.key" => "indicator_type"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_indicator_type"
        }
      }
    }

    mutate {
      replace => {
        "temp_indicator.value" => "%{seen.indicator}"
      }
      on_error => "indicator_not_found"
    }

    if ![indicator_not_found] and [temp_indicator][value] != "" {
      mutate {
        replace => {
          "temp_indicator.key" => "indicator"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_indicator"
        }
      }
    }

    mutate {
      replace => {
        "temp_where.value" => "%{seen.where}"
      }
      on_error => "where_not_found"
    }

    if ![where_not_found] and [temp_where][value] != "" {
      mutate {
        replace => {
          "temp_where.key" => "where"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_where"
        }
      }
    }
    mutate {
      replace => {
        "token_source" => ""
      }
    }
    for source in sources {
      mutate {
        replace => {
          "token_source" => "%{token_source}, '%{source}'"
        }
        on_error => "source_not_found"
      }
    }

    mutate {
      gsub => ["token_source", "^, ", ""]
    }

    mutate {
      replace => {
        "temp_sources.value" => "%{token_source}"
      }
      on_error => "sources_not_found"
    }
    if ![sources_not_found] and [temp_sources][value] != "" {
      mutate {
        replace => {
          "temp_sources.key" => "sources"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_sources"
        }
      }
    }

    mutate {
      replace => {
        "token_confidence" => ""
      }
    }
    for conf in confidence {
      mutate {
        convert => {
          "conf" => "string"
        }
      }
      mutate {
        replace => {
          "token_confidence" => "%{token_confidence}, %{conf}"
        }
        on_error => "conf_not_found"
      }
    }

    mutate {
      gsub => ["token_confidence", "^, ", ""]
    }

    mutate {
      replace => {
        "temp_confidence.value" => "%{token_confidence}"
      }
      on_error => "confidence_not_found"
    }

    if ![confidence_not_found] and [temp_confidence][value] != "" {
      mutate {
        replace => {
          "temp_confidence.key" => "confidence"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_confidence"
        }
      }
    }

    mutate {
      replace => {
        "token_category" => ""
      }
    }
    for cat in category {
      mutate {
        replace => {
          "token_category" => "%{token_category}, '%{cat}'"
        }
        on_error => "cat_not_found"
      }
    }

    mutate {
      gsub => ["token_category", "^, ", ""]
    }

    mutate {
      replace => {
        "temp_category.value" => "%{token_category}"
      }
      on_error => "category_not_found"
    }

    if ![category_not_found] and [temp_category][value] != "" {
      mutate {
        replace => {
          "temp_category.key" => "category"
        }
      }

      mutate {
        merge => {
          "token_about.labels" => "temp_category"
        }
      }
    }

    mutate {
      rename => {
        "token_about" => "intel_about"
      }
    }

    for match in matched {
      mutate {
        replace => {
          "token_match" => ""
        }
      }

      mutate {
        replace => {
          "token_match.value" => "%{match}"
        }
        on_error => "match_not_found"
      }

      if ![match_not_found] and [match] != "" {
        mutate {
          replace => {
            "token_match.key" => "matched"
          }
        }

        mutate {
          merge => {
            "token_entity.labels" => "token_match"
          }
        }
      }
    }

    mutate {
      merge => {
        "intel_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "token_fuid.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }

    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "token_fuid.key" => "fuid"
        }
      }

      mutate {
        merge => {
          "intel_about.labels" => "token_fuid"
        }
      }

      mutate {
        merge => {
          "token_entity.labels" => "token_fuid"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "intel_about"
      }
      on_error => "failed_to_merge_about"
    }

    mutate {
      replace => {
        "token_entity.file.mime_type" => "%{file_mime_type}"
      }
      on_error => "file_mime_type_not_found"
    }

    for index, ele_associated in associated {
      mutate {
        replace => {
          "token_associated" => ""
        }
      }

      mutate {
        replace => {
          "token_associated.value" => "%{ele_associated}"
        }
        on_error => "associated_not_found"
      }

      if ![associated_not_found] and [ele_associated] != "" {
        mutate {
          replace => {
            "token_associated.key" => "associated"
          }
        }

        mutate {
          merge => {
            "token_entity.labels" => "token_associated"
          }
        }
      }
    }

    for campaign in campaigns {
      mutate {
        replace => {
          "token_campaign" => ""
        }
      }

      mutate {
        replace => {
          "token_campaign.value" => "%{campaign}"
        }
        on_error => "campaign_not_found"
      }

      if ![campaign_not_found] and [campaign] != "" {
        mutate {
          replace => {
            "token_campaign.key" => "campaign"
          }
        }

        mutate {
          merge => {
            "token_entity.labels" => "token_campaign"
          }
        }
      }
    }

    for report in reports {
      mutate {
        replace => {
          "token_report" => ""
        }
      }

      mutate {
        replace => {
          "token_report.value" => "%{report}"
        }
        on_error => "report_not_found"
      }

      if ![report_not_found] and [report] != "" {
        mutate {
          replace => {
            "token_report.key" => "report"
          }
        }

        mutate {
          merge => {
            "token_entity.labels" => "token_report"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_file_desc.value" => "%{file_desc}"
      }
      on_error => "file_desc_not_found"
    }

    if [file_desc_not_found] or (![file_desc_not_found] and [file_desc] != "") {
      mutate {
        replace => {
          "token_file_desc.value" => "dummy_file_desc"
        }
      }
    }

    mutate {
      replace => {
        "token_file_desc.key" => "file_desc"
      }
    }

    mutate {
      merge => {
        "intel_security_result.detection_fields" => "token_file_desc"
      }
    }

    for index, ele_url in url {
      if [index] == 0 {
        mutate {
          replace => {
            "intel_security_result.url_back_to_product" => "%{ele_url}"
          }
          on_error => "ele_url_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "url_security_result" => ""
          }
        }

        mutate {
          replace => {
            "url_security_result.url_back_to_product" => "%{ele_url}"
          }
          on_error => "ele_url_not_found"
        }

        mutate {
          merge => {
            "token_security_result" => "url_security_result"
          }
          on_error => "failed_to_merge_security_result"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "intel_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    for index, ele_desc in desc {
      if [index] == 0 {
        mutate {
          replace => {
            "token_ioc.description" => "%{ele_desc}"
          }
          on_error => "ele_desc_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "token_description" => ""
          }
        }

        mutate {
          replace => {
            "token_description.value" => "%{ele_desc}"
          }
          on_error => "ele_desc_not_found"
        }

        if ![ele_desc_not_found] and [ele_desc] != "" {
          mutate {
            replace => {
              "token_description.key" => "desc"
            }
          }

          mutate {
            merge => {
              "token_entity.labels" => "token_description"
            }
          }
        }
      }
    }

    for index, ele_confidence_score in confidence {
      mutate {
        convert => {
          "ele_confidence_score" => "string"
        }
        on_error => "failed_to_convert_confidence_score"
      }

      if [index] == 0 {

        mutate {
          replace => {
            "token_ioc.confidence_score" => "%{ele_confidence_score}"
          }
          on_error => "ele_confidence_score_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "token_confidence_score" => ""
          }
        }

        mutate {
          replace => {
            "token_confidence_score.value" => "%{ele_confidence_score}"
          }
          on_error => "ele_confidence_score_not_found"
        }

        if ![ele_confidence_score_not_found] and [ele_confidence_score] != "" {
          mutate {
            replace => {
              "token_confidence_score.key" => "confidence_score"
            }
          }

          mutate {
            merge => {
              "token_entity.labels" => "token_confidence_score"
            }
          }
        }
      }
    }

    for index, ele_category in category {
      if [index] == 0 {

        mutate {
          replace => {
            "token_ioc.categorization" => "%{ele_category}"
          }
          on_error => "ele_category_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "token_category" => ""
          }
        }

        mutate {
          replace => {
            "token_category.value" => "%{ele_category}"
          }
          on_error => "ele_category_not_found"
        }

        if ![ele_category_not_found] and [ele_category] != "" {
          mutate {
            replace => {
              "token_category.key" => "category"
            }
          }

          mutate {
            merge => {
              "token_entity.labels" => "token_category"
            }
          }
        }
      }
    }

    mutate {
      replace => {
        "inteval_start_time_not_found" => "true"
      }
    }

    for index, ele_firstseen in firstseen {
      if [index] == 0 {
        date {
          match => ["ele_firstseen", "ISO8601"]
          target => "token_ioc.active_timerange.start"
          on_error => "ele_first_seen_not_found"
        }

        date {
          match => ["ele_firstseen", "ISO8601"]
          target => "entity_metadata.interval.start_time"
          on_error => "ele_first_seen_not_found"
        }

        if ![ele_first_seen_not_found] {
          mutate {
            replace => {
              "inteval_start_time_not_found" => "false"
            }
          }
        }

      }
      else {
        mutate {
          replace => {
            "token_firstseen" => ""
          }
        }

        mutate {
          replace => {
            "token_firstseen.value" => "%{ele_firstseen}"
          }
          on_error => "ele_firstseen_not_found"
        }

        if ![ele_firstseen_not_found] and [ele_firstseen] != "" {
          mutate {
            replace => {
              "token_firstseen.key" => "firstseen"
            }
          }

          mutate {
            merge => {
              "token_entity.labels" => "token_firstseen"
            }
          }
        }
      }
    }

    if [inteval_start_time_not_found] == "true" {
      date {
        match => ["ts", "RFC3339" ]
        target => "entity_metadata.interval.start_time"
        on_error => "ts_not_found"
      }
      if ![ts_not_found] {
        mutate {
          replace => {
            "inteval_start_time_not_found" => "false"
          }
        }
      }
    }

    for index, ele_lastseen in lastseen {
      if [index] == 0 {
        date {
          match => ["ele_lastseen", "ISO8601"]
          target => "token_ioc.active_timerange.end"
          on_error => "ele_last_seen_not_found"
        }

        date {
          match => ["ele_lastseen", "ISO8601"]
          target => "entity_metadata.interval.end_time"
          on_error => "ele_last_seen_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "token_lastseen" => ""
          }
        }

        mutate {
          replace => {
            "token_lastseen.value" => "%{ele_lastseen}"
          }
          on_error => "ele_lastseen_not_found"
        }

        if ![ele_lastseen_not_found] and [ele_lastseen] != "" {
          mutate {
            replace => {
              "token_lastseen.key" => "lastseen"
            }
          }

          mutate {
            merge => {
              "token_entity.labels" => "token_lastseen"
            }
          }
        }
      }
    }

    mutate {
      convert => {
        "id.vlan" => "string"
      }
      on_error => "id_vlan_conversion_error"
    }

    mutate {
      replace => {
        "id_vlan_label.value.string_value" => "%{id.vlan}"
      }
      on_error => "id_vlan_not_found"
    }

    if ![id_vlan_not_found] and
      [id_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_vlan_label.key" => "id_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "id.vlan_inner" => "string"
      }
      on_error => "id_vlan_inner_conversion_error"
    }

    mutate {
      replace => {
        "id_vlan_inner_label.value.string_value" => "%{id.vlan_inner}"
      }
      on_error => "id_vlan_inner_not_found"
    }

    if ![id_vlan_inner_not_found] and
      [id_vlan_inner_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_vlan_inner_label.key" => "id_vlan_inner"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_vlan_inner_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_cid" => "string"
      }
      on_error => "id_orig_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_cid_label.value.string_value" => "%{id.orig_ep_cid}"
      }
      on_error => "id_orig_ep_cid_not_found"
    }

    if ![id_orig_ep_cid_not_found] and
      [id_orig_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_cid_label.key" => "id_orig_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_source" => "string"
      }
      on_error => "id_orig_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_source_label.value.string_value" =>
        "%{id.orig_ep_source}"
      }
      on_error => "id_orig_ep_source_not_found"
    }

    if ![id_orig_ep_source_not_found] and
      [id_orig_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_source_label.key" => "id_orig_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_status" => "string"
      }
      on_error => "id_orig_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_status_label.value.string_value" =>
        "%{id.orig_ep_status}"
      }
      on_error => "id_orig_ep_status_not_found"
    }

    if ![id_orig_ep_status_not_found] and
      [id_orig_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_status_label.key" => "id_orig_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "id.orig_ep_uid" => "string"
      }
      on_error => "id_orig_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "id_orig_ep_uid_label.value.string_value" => "%{id.orig_ep_uid}"
      }
      on_error => "id_orig_ep_uid_not_found"
    }

    if ![id_orig_ep_uid_not_found] and
      [id_orig_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_orig_ep_uid_label.key" => "id_orig_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_orig_ep_uid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_cid" => "string"
      }
      on_error => "id_resp_ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_cid_label.value.string_value" => "%{id.resp_ep_cid}"
      }
      on_error => "id_resp_ep_cid_not_found"
    }

    if ![id_resp_ep_cid_not_found] and
      [id_resp_ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_cid_label.key" => "id_resp_ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_source" => "string"
      }
      on_error => "id_resp_ep_source_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_source_label.value.string_value" =>
        "%{id.resp_ep_source}"
      }
      on_error => "id_resp_ep_source_not_found"
    }

    if ![id_resp_ep_source_not_found] and
      [id_resp_ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_source_label.key" => "id_resp_ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_status" => "string"
      }
      on_error => "id_resp_ep_status_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_status_label.value.string_value" =>
        "%{id.resp_ep_status}"
      }
      on_error => "id_resp_ep_status_not_found"
    }

    if ![id_resp_ep_status_not_found] and
      [id_resp_ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_status_label.key" => "id_resp_ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "id.resp_ep_uid" => "string"
      }
      on_error => "id_resp_ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "id_resp_ep_uid_label.value.string_value" => "%{id.resp_ep_uid}"
      }
      on_error => "id_resp_ep_uid_not_found"
    }

    if ![id_resp_ep_uid_not_found] and
      [id_resp_ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "id_resp_ep_uid_label.key" => "id_resp_ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "id_resp_ep_uid_label"
        }
      }
    }

    # UDM > entity > security_result
    for score in threat_score {
      mutate {
        convert => {
          "score" => "string"
        }
        on_error => "score_conversion_error"
      }

      mutate {
        replace => {
          "threat_score_label.value" => "%{score}"
        }
        on_error => "score_not_found"
      }

      if ![score_not_found] and [score] != "" {
        mutate {
          replace => {
            "threat_score_label.key" => "threat_score"
          }
        }
        mutate {
          merge => {
            "threat_score_security_result.detection_fields" =>
            "threat_score_label"
          }
          remove_field => ["threat_score_label"]
        }
      }
    }

    for verd in verdict {
      if [verd] =~ "(?i)Malicious" or [verd] == "1" {
        mutate {
          replace => {
            "verdict_info.verdict_response" => "MALICIOUS"
          }
        }
      }else if [verd] =~ "(?i)Benign" or [verd] == "2" {
        mutate {
          replace => {
            "verdict_info.verdict_response" => "BENIGN"
          }
        }
      }else {
        mutate {
          replace => {
            "verdict_info.verdict_response" => "VERDICT_RESPONSE_UNSPECIFIED"
          }
        }
      }

      mutate {
        merge => {
          "threat_score_security_result.verdict_info" => "verdict_info"
        }
        on_error => "verdict_info_not_found"
        remove_field => ["verdict_info"]
      }
    }

    for src in verdict_source {
      mutate {
        replace => {
          "verdict_info.source_provider" => "%{src}"
        }
        on_error => "verdict_source_not_found"
      }

      mutate {
        merge => {
          "threat_score_security_result.verdict_info" => "verdict_info"
        }
        on_error => "verdict_info_not_found"
        remove_field => ["verdict_info"]
      }
    }

    mutate {
      merge => {
        "token_entity.security_result" => "threat_score_security_result"
      }
      on_error => "threat_score_security_result_not_found"
    }

    # Check if required udm validation fields for SCAN_NETWORK exist.
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "SCAN_NETWORK"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [indicator_type_not_found] or [required_field_not_found] == "true" or
    [inteval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "token_ioc" => "event1.ioc"
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }

    mutate {
      merge => {
        "@output" => "event1"
      }
      on_error => "failed_to_merge_event_1"
    }
  }

  # ----------------------------------------------------------------------
  # BACNET
  else if [_path] == "bacnet" {

    # UDM > About
    mutate {
      replace => {
        "token_bvlc_function.value" => "%{bvlc_function}"
      }
      on_error => "bvlc_function_not_found"
    }

    if ![bvlc_function_not_found] and [bvlc_function] != "" {
      mutate {
        replace => {
          "token_bvlc_function.key" => "bvlc_function"
        }
      }

      mutate {
        merge => {
          "bacnet_about.labels" => "token_bvlc_function"
        }
      }
    }

    mutate {
      convert => {
        "bvlc_len" => "string"
      }
      on_error => "bvlc_conversion_error"
    }

    mutate {
      replace => {
        "token_bvlc_len.value" => "%{bvlc_len}"
      }
      on_error => "bvlc_len_not_found"
    }

    if ![bvlc_len_not_found] and [bvlc_len] != "" {
      mutate {
        replace => {
          "token_bvlc_len.key" => "bvlc_len"
        }
      }

      mutate {
        merge => {
          "bacnet_about.labels" => "token_bvlc_len"
        }
      }
    }

    mutate {
      replace => {
        "token_apdu_type.value" => "%{apdu_type}"
      }
      on_error => "apdu_type_not_found"
    }

    if ![apdu_type_not_found] and [apdu_type] != "" {
      mutate {
        replace => {
          "token_apdu_type.key" => "apdu_type"
        }
      }

      mutate {
        merge => {
          "bacnet_about.labels" => "token_apdu_type"
        }
      }
    }

    mutate {
      replace => {
        "token_service_choice.value" => "%{service_choice}"
      }
      on_error => "service_choice_not_found"
    }

    if ![service_choice_not_found] and [service_choice] != "" {
      mutate {
        replace => {
          "token_service_choice.key" => "service_choice"
        }
      }

      mutate {
        merge => {
          "bacnet_about.labels" => "token_service_choice"
        }
      }
    }

    for object in data {
      grok {
        match => {
          "object" => [ "%{GREEDYDATA:data_key}=%{GREEDYDATA:data_value}" ]
        }
        overwrite => [ "data_key", "data_value" ]
        on_error => "object_not_found"
      }

      if ![object_not_found] {
        mutate {
          replace => {
            "token_data" => ""
          }
        }

        mutate {
          replace => {
            "token_data.value" => "%{data_value}"
            "token_data.key" => "%{data_key}"
          }
          on_error => "data_value_not_found"
        }

        if ![data_value_not_found] and [data_value] != "" and [data_key] != "" {
          mutate {
            merge => {
              "bacnet_about.labels" => "token_data"
            }
          }
        }
      }
    }

    mutate {
      merge => {
        "bacnet_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "bacnet_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "invoke_id" => "string"
      }
      on_error => "invoke_id_conversion_error"
    }

    mutate {
      replace => {
        "invoke_id_label.value.string_value" => "%{invoke_id}"
      }
      on_error => "invoke_id_not_found"
    }

    if ![invoke_id_not_found] and
      [invoke_id_label][value][string_value] != "" {
      mutate {
        replace => {
          "invoke_id_label.key" => "invoke_id"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "invoke_id_label"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_label.value.string_value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }

    if ![is_orig_not_found] and
      [is_orig_label][value][string_value] != "" {
      mutate {
        replace => {
          "is_orig_label.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "is_orig_label"
        }
      }
    }

    mutate {
      convert => {
        "pdu_service" => "string"
      }
      on_error => "pdu_service_conversion_error"
    }

    mutate {
      replace => {
        "pdu_service_label.value.string_value" => "%{pdu_service}"
      }
      on_error => "pdu_service_not_found"
    }

    if ![pdu_service_not_found] and
      [pdu_service_label][value][string_value] != "" {
      mutate {
        replace => {
          "pdu_service_label.key" => "pdu_service"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "pdu_service_label"
        }
      }
    }

    mutate {
      convert => {
        "pdu_type" => "string"
      }
      on_error => "pdu_type_conversion_error"
    }

    mutate {
      replace => {
        "pdu_type_label.value.string_value" => "%{pdu_type}"
      }
      on_error => "pdu_type_not_found"
    }

    if ![pdu_type_not_found] and
      [pdu_type_label][value][string_value] != "" {
      mutate {
        replace => {
          "pdu_type_label.key" => "pdu_type"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "pdu_type_label"
        }
      }
    }

    mutate {
      convert => {
        "result_code" => "string"
      }
      on_error => "result_code_conversion_error"
    }

    mutate {
      replace => {
        "result_code_label.value.string_value" => "%{result_code}"
      }
      on_error => "result_code_not_found"
    }

    if ![result_code_not_found] and
      [result_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "result_code_label.key" => "result_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "result_code_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # CIP
  else if [_path] == "cip" {

    # UDM > About
    mutate {
      replace => {
        "service_labels.value" => "%{service}"
      }
      on_error => "service_not_found"
    }
    if ![service_not_found] and [service] != "" {
      mutate {
        replace => {
          "service_labels.key" => "service"
        }
      }
      mutate {
        merge => {
          "cip_about.labels" => "service_labels"
        }
      }
    }

    mutate {
      replace => {
        "status_labels.value" => "%{status}"
      }
      on_error => "status_not_found"
    }
    if ![status_not_found] and [status] != "" {
      mutate {
        replace => {
          "status_labels.key" => "status"
        }
      }
      mutate {
        merge => {
          "cip_about.labels" => "status_labels"
        }
      }
    }

    mutate {
      replace => {
        "tags_labels.value" => "%{tags}"
      }
      on_error => "tags_not_found"
    }
    if ![tags_not_found] and [tags] != "" {
      mutate {
        replace => {
          "tags_labels.key" => "tag"
        }
      }
      mutate {
        merge => {
          "cip_about.labels" => "tags_labels"
        }
      }
    }

    mutate {
      merge => {
        "cip_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "cip_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "attribute_id" => "string"
      }
      on_error => "attribute_id_conversion_error"
    }

    mutate {
      replace => {
        "attribute_id_label.value.string_value" => "%{attribute_id}"
      }
      on_error => "attribute_id_not_found"
    }

    if ![attribute_id_not_found] and
      [attribute_id_label][value][string_value] != "" {
      mutate {
        replace => {
          "attribute_id_label.key" => "attribute_id"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "attribute_id_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_extended_status" => "string"
      }
      on_error => "cip_extended_status_conversion_error"
    }

    mutate {
      replace => {
        "cip_extended_status_label.value.string_value" =>
        "%{cip_extended_status}"
      }
      on_error => "cip_extended_status_not_found"
    }

    if ![cip_extended_status_not_found] and
      [cip_extended_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_extended_status_label.key" => "cip_extended_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_extended_status_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_extended_status_code" => "string"
      }
      on_error => "cip_extended_status_code_conversion_error"
    }

    mutate {
      replace => {
        "cip_extended_status_code_label.value.string_value" =>
        "%{cip_extended_status_code}"
      }
      on_error => "cip_extended_status_code_not_found"
    }

    if ![cip_extended_status_code_not_found] and
      [cip_extended_status_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_extended_status_code_label.key" => "cip_extended_status_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_extended_status_code_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_sequence_count" => "string"
      }
      on_error => "cip_sequence_count_conversion_error"
    }

    mutate {
      replace => {
        "cip_sequence_count_label.value.string_value" =>
        "%{cip_sequence_count}"
      }
      on_error => "cip_sequence_count_not_found"
    }

    if ![cip_sequence_count_not_found] and
      [cip_sequence_count_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_sequence_count_label.key" => "cip_sequence_count"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_sequence_count_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_service" => "string"
      }
      on_error => "cip_service_conversion_error"
    }

    mutate {
      replace => {
        "cip_service_label.value.string_value" => "%{cip_service}"
      }
      on_error => "cip_service_not_found"
    }

    if ![cip_service_not_found] and
      [cip_service_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_service_label.key" => "cip_service"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_service_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_service_code" => "string"
      }
      on_error => "cip_service_code_conversion_error"
    }

    mutate {
      replace => {
        "cip_service_code_label.value.string_value" => "%{cip_service_code}"
      }
      on_error => "cip_service_code_not_found"
    }

    if ![cip_service_code_not_found] and
      [cip_service_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_service_code_label.key" => "cip_service_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_service_code_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_status" => "string"
      }
      on_error => "cip_status_conversion_error"
    }

    mutate {
      replace => {
        "cip_status_label.value.string_value" => "%{cip_status}"
      }
      on_error => "cip_status_not_found"
    }

    if ![cip_status_not_found] and
      [cip_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_status_label.key" => "cip_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_status_label"
        }
      }
    }

    mutate {
      convert => {
        "cip_status_code" => "string"
      }
      on_error => "cip_status_code_conversion_error"
    }

    mutate {
      replace => {
        "cip_status_code_label.value.string_value" => "%{cip_status_code}"
      }
      on_error => "cip_status_code_not_found"
    }

    if ![cip_status_code_not_found] and
      [cip_status_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "cip_status_code_label.key" => "cip_status_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "cip_status_code_label"
        }
      }
    }

    mutate {
      convert => {
        "class_id" => "string"
      }
      on_error => "class_id_conversion_error"
    }

    mutate {
      replace => {
        "class_id_label.value.string_value" => "%{class_id}"
      }
      on_error => "class_id_not_found"
    }

    if ![class_id_not_found] and
      [class_id_label][value][string_value] != "" {
      mutate {
        replace => {
          "class_id_label.key" => "class_id"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "class_id_label"
        }
      }
    }

    mutate {
      convert => {
        "class_name" => "string"
      }
      on_error => "class_name_conversion_error"
    }

    mutate {
      replace => {
        "class_name_label.value.string_value" => "%{class_name}"
      }
      on_error => "class_name_not_found"
    }

    if ![class_name_not_found] and
      [class_name_label][value][string_value] != "" {
      mutate {
        replace => {
          "class_name_label.key" => "class_name"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "class_name_label"
        }
      }
    }

    mutate {
      convert => {
        "direction" => "string"
      }
      on_error => "direction_conversion_error"
    }

    mutate {
      replace => {
        "direction_label.value.string_value" => "%{direction}"
      }
      on_error => "direction_not_found"
    }

    if ![direction_not_found] and
      [direction_label][value][string_value] != "" {
      mutate {
        replace => {
          "direction_label.key" => "direction"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "direction_label"
        }
      }
    }

    mutate {
      convert => {
        "instance_id" => "string"
      }
      on_error => "instance_id_conversion_error"
    }

    mutate {
      replace => {
        "instance_id_label.value.string_value" => "%{instance_id}"
      }
      on_error => "instance_id_not_found"
    }

    if ![instance_id_not_found] and
      [instance_id_label][value][string_value] != "" {
      mutate {
        replace => {
          "instance_id_label.key" => "instance_id"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "instance_id_label"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_label.value.string_value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }

    if ![is_orig_not_found] and
      [is_orig_label][value][string_value] != "" {
      mutate {
        replace => {
          "is_orig_label.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "is_orig_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # CORELIGHT_BURST
  else if [_path] == "corelight_burst" {

    # UDM > Network
    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    mutate {
      convert => {
        "orig_size" => "uinteger"
      }
      on_error => "orig_size_conversion_failed"
    }

    mutate {
      rename => {
        "orig_size" => "token_network.sent_bytes"
      }
      on_error => "orig_size_not_set"
    }

    mutate {
      convert => {
        "resp_size" => "uinteger"
      }
      on_error => "resp_size_conversion_failed"
    }

    mutate {
      rename => {
        "resp_size" => "token_network.received_bytes"
      }
      on_error => "resp_size_not_set"
    }

    # UDM > About
    mutate {
      merge => {
        "corelight_burst_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "mbps" => "string"
      }
      on_error => "mbps_conversion_error"
    }

    mutate {
      replace => {
        "mbps_labels.value" => "%{mbps}"
      }
      on_error => "mbps_not_found"
    }
    if ![mbps_not_found] and [mbps] != "" {
      mutate {
        replace => {
          "mbps_labels.key" => "mbps"
        }
      }
      mutate {
        merge => {
          "corelight_burst_about.labels" => "mbps_labels"
        }
      }
    }

    mutate {
      convert => {
        "age_of_conn" => "string"
      }
      on_error => "age_of_conn_conversion_error"
    }

    mutate {
      replace => {
        "age_of_conn_labels.value" => "%{age_of_conn}"
      }
      on_error => "age_of_conn_not_found"
    }
    if ![age_of_conn_not_found] and [age_of_conn] != "" {
      mutate {
        replace => {
          "age_of_conn_labels.key" => "age_of_conn"
        }
      }
      mutate {
        merge => {
          "corelight_burst_about.labels" => "age_of_conn_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "corelight_burst_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
    # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled
    mutate {
      replace => {
        "token_principal.hostname" => "%{id.orig_h}"
      }
      on_error => "id_orig_h_not_found"
    }

    # Check if required udm validation fields for SCAN_NETWORK exist.
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "SCAN_NETWORK"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # CORELIGHT_OVERALL_CAPTURE_LOSS
  else if [_path] == "corelight_overall_capture_loss" {

    # UDM > Security Result
    mutate {
      convert => {
        "gaps" => "string"
      }
      on_error => "gaps_conversion_error"
    }

    mutate {
      replace => {
        "gaps_labels.value" => "%{gaps}"
      }
      on_error => "gaps_not_found"
    }
    if ![gaps_not_found] and [gaps] != "" {
      mutate {
        replace => {
          "gaps_labels.key" => "gaps"
        }
      }
      mutate {
        merge => {
          "capture_loss_security_result.detection_fields" => "gaps_labels"
        }
      }
    }

    mutate {
      convert => {
        "acks" => "string"
      }
      on_error => "acks_conversion_error"
    }

    mutate {
      replace => {
        "acks_labels.value" => "%{acks}"
      }
      on_error => "acks_not_found"
    }
    if ![acks_not_found] and [acks] != "" {
      mutate {
        replace => {
          "acks_labels.key" => "acks"
        }
      }
      mutate {
        merge => {
          "capture_loss_security_result.detection_fields" => "acks_labels"
        }
      }
    }

    mutate {
      convert => {
        "percent_lost" => "string"
      }
      on_error => "percent_lost_conversion_error"
    }

    mutate {
      replace => {
        "percent_lost_labels.value" => "%{percent_lost}"
      }
      on_error => "percent_lost_not_found"
    }
    if ![percent_lost_not_found] and [percent_lost] != "" {
      mutate {
        replace => {
          "percent_lost_labels.key" => "percent_lost"
        }
      }
      mutate {
        merge => {
          "capture_loss_security_result.detection_fields" =>
          "percent_lost_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_metadata.description" =>
        "node %{_system_name} experienced %{percent_lost}% packet loss at %{ts}."
      }
      on_error => "failed_to_set_description"
    }

    mutate {
      merge => {
        "token_security_result" => "capture_loss_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }
  }

  # ----------------------------------------------------------------------
  # CORELIGHT_PROFILING
  else if [_path] == "corelight_profiling" {

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.hostname" => "%{node}"
      }
      on_error => "node_not_found"
    }

    if ![node_not_found] {
      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }
    else {
      # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
      # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled

      mutate {
        replace => {
          "token_principal.hostname" => "%{id.orig_h}"
        }
        on_error => "id_orig_h_not_found"
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "prof_core_stack_labels.value" => "%{prof.core_stack}"
      }
      on_error => "prof_core_stack_not_found"
    }
    if ![prof_core_stack_not_found] and [prof][core_stack] != "" {
      mutate {
        replace => {
          "prof_core_stack_labels.key" => "prof_core_stack"
        }
      }
      mutate {
        merge => {
          "corelight_profiling_about.labels" => "prof_core_stack_labels"
        }
      }
    }

    mutate {
      replace => {
        "prof_script_stack_labels.value" => "%{prof.script_stack}"
      }
      on_error => "prof_script_stack_not_found"
    }
    if ![prof_script_stack_not_found] and [prof][script_stack] != "" {
      mutate {
        replace => {
          "prof_script_stack_labels.key" => "prof_script_stack"
        }
      }
      mutate {
        merge => {
          "corelight_profiling_about.labels" => "prof_script_stack_labels"
        }
      }
    }

    mutate {
      convert => {
        "prof.sched_wait_ns" => "string"
      }
      on_error => "prof_sched_wait_ns_conversion_error"
    }

    mutate {
      replace => {
        "prof_sched_wait_ns_labels.value" => "%{prof.sched_wait_ns}"
      }
      on_error => "prof_sched_wait_ns_not_found"
    }
    if ![prof_sched_wait_ns_not_found] and [prof][sched_wait_ns] != "" {
      mutate {
        replace => {
          "prof_sched_wait_ns_labels.key" => "prof_sched_wait_ns"
        }
      }
      mutate {
        merge => {
          "corelight_profiling_about.labels" => "prof_sched_wait_ns_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "corelight_profiling_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for SCAN_NETWORK exist.
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "SCAN_NETWORK"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # DATARED
  else if [_path] == "datared" {

    # UDM > About
    mutate {
      convert => {
        "conn_red" => "string"
      }
      on_error => "conn_red_conversion_error"
    }

    mutate {
      replace => {
        "conn_red_labels.value" => "%{conn_red}"
      }
      on_error => "conn_red_not_found"
    }
    if ![conn_red_not_found] and [conn_red] != "" {
      mutate {
        replace => {
          "conn_red_labels.key" => "conn_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "conn_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "conn_total" => "string"
      }
      on_error => "conn_total_conversion_error"
    }

    mutate {
      replace => {
        "conn_total_labels.value" => "%{conn_total}"
      }
      on_error => "conn_total_not_found"
    }
    if ![conn_total_not_found] and [conn_total] != "" {
      mutate {
        replace => {
          "conn_total_labels.key" => "conn_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "conn_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "dns_red" => "string"
      }
      on_error => "dns_red_conversion_error"
    }

    mutate {
      replace => {
        "dns_red_labels.value" => "%{dns_red}"
      }
      on_error => "dns_red_not_found"
    }
    if ![dns_red_not_found] and [dns_red] != "" {
      mutate {
        replace => {
          "dns_red_labels.key" => "dns_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "dns_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "dns_total" => "string"
      }
      on_error => "dns_total_conversion_error"
    }

    mutate {
      replace => {
        "dns_total_labels.value" => "%{dns_total}"
      }
      on_error => "dns_total_not_found"
    }
    if ![dns_total_not_found] and [dns_total] != "" {
      mutate {
        replace => {
          "dns_total_labels.key" => "dns_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "dns_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "dns_coal_miss" => "string"
      }
      on_error => "dns_coal_miss_conversion_error"
    }

    mutate {
      replace => {
        "dns_coal_miss_labels.value" => "%{dns_coal_miss}"
      }
      on_error => "dns_coal_miss_not_found"
    }
    if ![dns_coal_miss_not_found] and [dns_coal_miss] != "" {
      mutate {
        replace => {
          "dns_coal_miss_labels.key" => "dns_coal_miss"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "dns_coal_miss_labels"
        }
      }
    }

    mutate {
      convert => {
        "files_red" => "string"
      }
      on_error => "files_red_conversion_error"
    }

    mutate {
      replace => {
        "files_red_labels.value" => "%{files_red}"
      }
      on_error => "files_red_not_found"
    }
    if ![files_red_not_found] and [files_red] != "" {
      mutate {
        replace => {
          "files_red_labels.key" => "files_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "files_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "files_total" => "string"
      }
      on_error => "files_total_conversion_error"
    }

    mutate {
      replace => {
        "files_total_labels.value" => "%{files_total}"
      }
      on_error => "files_total_not_found"
    }
    if ![files_total_not_found] and [files_total] != "" {
      mutate {
        replace => {
          "files_total_labels.key" => "files_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "files_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "files_coal_miss" => "string"
      }
      on_error => "files_coal_miss_conversion_error"
    }

    mutate {
      replace => {
        "files_coal_miss_labels.value" => "%{files_coal_miss}"
      }
      on_error => "files_coal_miss_not_found"
    }
    if ![files_coal_miss_not_found] and [files_coal_miss] != "" {
      mutate {
        replace => {
          "files_coal_miss_labels.key" => "files_coal_miss"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "files_coal_miss_labels"
        }
      }
    }

    mutate {
      convert => {
        "http_red" => "string"
      }
      on_error => "http_red_conversion_error"
    }

    mutate {
      replace => {
        "http_red_labels.value" => "%{http_red}"
      }
      on_error => "http_red_not_found"
    }
    if ![http_red_not_found] and [http_red] != "" {
      mutate {
        replace => {
          "http_red_labels.key" => "http_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "http_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "http_total" => "string"
      }
      on_error => "http_total_conversion_error"
    }

    mutate {
      replace => {
        "http_total_labels.value" => "%{http_total}"
      }
      on_error => "http_total_not_found"
    }
    if ![http_total_not_found] and [http_total] != "" {
      mutate {
        replace => {
          "http_total_labels.key" => "http_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "http_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "ssl_red" => "string"
      }
      on_error => "ssl_red_conversion_error"
    }

    mutate {
      replace => {
        "ssl_red_labels.value" => "%{ssl_red}"
      }
      on_error => "ssl_red_not_found"
    }
    if ![ssl_red_not_found] and [ssl_red] != "" {
      mutate {
        replace => {
          "ssl_red_labels.key" => "ssl_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "ssl_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "ssl_total" => "string"
      }
      on_error => "ssl_total_conversion_error"
    }

    mutate {
      replace => {
        "ssl_total_labels.value" => "%{ssl_total}"
      }
      on_error => "ssl_total_not_found"
    }
    if ![ssl_total_not_found] and [ssl_total] != "" {
      mutate {
        replace => {
          "ssl_total_labels.key" => "ssl_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "ssl_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "ssl_coal_miss" => "string"
      }
      on_error => "ssl_coal_miss_conversion_error"
    }

    mutate {
      replace => {
        "ssl_coal_miss_labels.value" => "%{ssl_coal_miss}"
      }
      on_error => "ssl_coal_miss_not_found"
    }
    if ![ssl_coal_miss_not_found] and [ssl_coal_miss] != "" {
      mutate {
        replace => {
          "ssl_coal_miss_labels.key" => "ssl_coal_miss"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "ssl_coal_miss_labels"
        }
      }
    }

    mutate {
      convert => {
        "weird_red" => "string"
      }
      on_error => "weird_red_conversion_error"
    }

    mutate {
      replace => {
        "weird_red_labels.value" => "%{weird_red}"
      }
      on_error => "weird_red_not_found"
    }
    if ![weird_red_not_found] and [weird_red] != "" {
      mutate {
        replace => {
          "weird_red_labels.key" => "weird_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "weird_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "weird_total" => "string"
      }
      on_error => "weird_total_conversion_error"
    }

    mutate {
      replace => {
        "weird_total_labels.value" => "%{weird_total}"
      }
      on_error => "weird_total_not_found"
    }
    if ![weird_total_not_found] and [weird_total] != "" {
      mutate {
        replace => {
          "weird_total_labels.key" => "weird_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "weird_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "x509_red" => "string"
      }
      on_error => "x509_red_conversion_error"
    }

    mutate {
      replace => {
        "x509_red_labels.value" => "%{x509_red}"
      }
      on_error => "x509_red_not_found"
    }
    if ![x509_red_not_found] and [x509_red] != "" {
      mutate {
        replace => {
          "x509_red_labels.key" => "x509_red"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "x509_red_labels"
        }
      }
    }

    mutate {
      convert => {
        "x509_total" => "string"
      }
      on_error => "x509_total_conversion_error"
    }

    mutate {
      replace => {
        "x509_total_labels.value" => "%{x509_total}"
      }
      on_error => "x509_total_not_found"
    }
    if ![x509_total_not_found] and [x509_total] != "" {
      mutate {
        replace => {
          "x509_total_labels.key" => "x509_total"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "x509_total_labels"
        }
      }
    }

    mutate {
      convert => {
        "x509_coal_miss" => "string"
      }
      on_error => "x509_coal_miss_conversion_error"
    }

    mutate {
      replace => {
        "x509_coal_miss_labels.value" => "%{x509_coal_miss}"
      }
      on_error => "x509_coal_miss_not_found"
    }
    if ![x509_coal_miss_not_found] and [x509_coal_miss] != "" {
      mutate {
        replace => {
          "x509_coal_miss_labels.key" => "x509_coal_miss"
        }
      }
      mutate {
        merge => {
          "datared_about.labels" => "x509_coal_miss_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "datared_about"
      }
      on_error => "failed_to_merge_about"
    }
  }

  # ----------------------------------------------------------------------
  # DHCP
  else if [_path] == "dhcp" {
    mutate {
      replace => {
        "is_dhcp_ciaddr_exist" => "false"
        "is_dhcp_yiaddr_exist" => "false"
      }
    }
    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "DHCP"
      }
    }

    mutate {
      replace => {
        "network_dhcp_present" => "false"
      }
    }

    grok {
      match => {
        "client_addr" => "%{IP:client_addr}"
      }
      overwrite => ["client_addr"]
      on_error => "client_addr_not_found"
    }
    if ![client_addr_not_found] {
      mutate {
        replace => {
          "is_dhcp_ciaddr_exist" => "true"
        }
      }

      mutate {
        replace => {
          "token_network.dhcp.ciaddr" => "%{client_addr}"
        }
      }

      # Duplicating the client_addr info into ip to skip the validation for NETWORK_DHCP.
      mutate {
        merge => {
          "token_principal.ip" => "client_addr"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    grok {
      match => {
        "server_addr" => "%{IP:server_addr}"
      }
      overwrite => ["server_addr"]
      on_error => "server_addr_not_found"
    }
    if ![server_addr_not_found] {
      mutate {
        replace => {
          "token_network.dhcp.siaddr" => "%{server_addr}"
        }
      }
    }

    grok {
      match => {
        "mac" => "%{MAC:mac}"
      }
      overwrite => ["mac"]
      on_error => "mac_not_matched"
    }
    if ![mac_not_matched] {
      mutate {
        replace => {
          "token_network.dhcp.chaddr" => "%{mac}"
        }
      }

      # Duplicating the mac info into ip to skip the validation for NETWORK_DHCP.
      mutate {
        merge => {
          "token_principal.mac" => "mac"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "token_network.dhcp.client_hostname" => "%{hostname}"
      }
      on_error => "hostname_not_found"
    }

    grok {
      match => {
        "requested_addr" => "%{IP:requested_addr}"
      }
      overwrite => ["requested_addr"]
      on_error => "requested_addr_not_found"
    }
    if ![requested_addr_not_found] {
      mutate {
        replace => {
          "token_network.dhcp.requested_address" => "%{requested_addr}"
        }
      }
    }

    grok {
      match => {
        "assigned_addr" => "%{IP:assigned_addr}"
      }
      overwrite => ["assigned_addr"]
      on_error => "assigned_addr_not_found"
    }
    if ![assigned_addr_not_found] {
      mutate {
        replace => {
          "is_dhcp_yiaddr_exist" => "true"
        }
      }

      mutate {
        replace => {
          "token_network.dhcp.yiaddr" => "%{assigned_addr}"
        }
      }
    }

    mutate {
      convert => {
        "lease_time" => "uinteger"
      }
      on_error => "failed_to_convert_lease_time"
    }

    mutate {
      rename => {
        "lease_time" => "token_network.dhcp.lease_time_seconds"
      }
    }

    for index,msg_type in msg_types {

      mutate {
        uppercase => ["msg_type"]
      }

      if [index] == 0 and [msg_type] in ["ACK", "DECLINE", "DISCOVER",
      "INFORM","NAK", "OFFER", "RELEASE", "REQUEST", "UNKNOWN_MESSAGE_TYPE",
      "WIN_DELETED", "WIN_EXPIRED"] {
        mutate {
          replace => {
            "token_network.dhcp.type" => "%{msg_type}"
          }
        }

        mutate {
          replace => {
            "network_dhcp_present" => "true"
          }
        }
      }
      else {
        mutate {
          replace => {
            "msg_type_labels" => ""
          }
        }

        mutate {
          replace => {
            "msg_type_labels.value" => "%{msg_type}"
          }
          on_error => "msg_type_not_found"
        }
        if ![msg_type_not_found] and [msg_type] != "" {
          mutate {
            replace => {
              "msg_type_labels.key" => "msg_type"
            }
          }
          mutate {
            merge => {
              "dhcp_about.labels" => "msg_type_labels"
            }
          }
        }
      }
    }

    if ![client_addr_not_found] or ![server_addr_not_found] or
    ![mac_not_matched] or ![hostname_not_found] or
    ![requested_addr_not_found] or ![assigned_addr_not_found] {
      mutate {
        replace => {
          "network_dhcp_present" => "true"
        }
      }
    }

    for uid in uids {
      mutate {
        replace => {
          "uid_labels" => ""
        }
      }

      mutate {
        replace => {
          "uid_labels.value" => "%{uid}"
        }
        on_error => "uid_not_found"
      }
      if ![uid_not_found] and [uid] != "" {
        mutate {
          replace => {
            "uid_labels.key" => "uid"
          }
        }
        mutate {
          merge => {
            "dhcp_about.labels" => "uid_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "dhcp_about.labels" => "duration_labels"
        }
      }
    }

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.domain.name" => "%{client_fqdn}"
      }
      on_error => "client_fqdn_not_found"
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.domain.name" => "%{domain}"
      }
      on_error => "domain_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "dhcp_security_result.description" => "%{client_message}"
      }
      on_error => "client_message_not_found"
    }

    mutate {
      replace => {
        "dhcp_security_result.description" => "%{server_message}"
      }
      on_error => "server_message_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "dhcp_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    mutate {
      merge => {
        "token_about" => "dhcp_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_DHCP exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [network_dhcp_present] == "true"
    and [is_dhcp_ciaddr_exist] == "true"
    and [is_dhcp_yiaddr_exist] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DHCP"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # DGA
  else if [_path] == "dga" {
    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "DNS"
      }
    }

    mutate {
      replace => {
        "questions.name" => "%{query}"
      }
      on_error => "query_not_found"
    }

    mutate {
      convert => {
        "rcode" => "uinteger"
      }
      on_error => "rcode_conversion_error"
    }

    mutate {
      rename => {
        "rcode" => "token_network.dns.response_code"
      }
    }

    mutate {
      merge => {
        "token_network.dns.questions" => "questions"
      }
      on_error => "query_not_found"
    }

    # UDM > About

    mutate {
      replace => {
        "family_labels.value" => "%{family}"
      }
      on_error => "family_not_found"
    }
    if ![family_not_found] and [family] != "" {
      mutate {
        replace => {
          "family_labels.key" => "family"
        }
      }
      mutate {
        merge => {
          "dga_about.labels" => "family_labels"
        }
      }
    }

    mutate {
      replace => {
        "qtype_name_labels.value" => "%{qtype_name}"
      }
      on_error => "qtype_name_not_found"
    }
    if ![qtype_name_not_found] and [qtype_name] != "" {
      mutate {
        replace => {
          "qtype_name_labels.key" => "qtype_name"
        }
      }
      mutate {
        merge => {
          "dga_about.labels" => "qtype_name_labels"
        }
      }
    }

    mutate {
      convert => {
        "ruse" => "string"
      }
      on_error => "ruse_conversion_error"
    }

    mutate {
      replace => {
        "ruse_labels.value" => "%{ruse}"
      }
      on_error => "ruse_not_found"
    }
    if ![ruse_not_found] and [ruse] != "" {
      mutate {
        replace => {
          "ruse_labels.key" => "ruse"
        }
      }
      mutate {
        merge => {
          "dga_about.labels" => "ruse_labels"
        }
      }
    }

    # UDM > Security Result

    mutate {
      convert => {
        "is_collision_heavy" => "string"
      }
      on_error => "is_collision_heavy_conversion_error"
    }

    mutate {
      replace => {
        "is_collision_heavy_labels.value" => "%{is_collision_heavy}"
      }
      on_error => "is_collision_heavy_not_found"
    }
    if ![is_collision_heavy_not_found] and [is_collision_heavy] != "" {
      mutate {
        replace => {
          "is_collision_heavy_labels.key" => "is_collision_heavy"
        }
      }
      mutate {
        merge => {
          "dga_security_result.detection_fields" => "is_collision_heavy_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "dga_about"
      }
      on_error => "failed_to_merge_about"
    }

    mutate {
      merge => {
        "token_security_result" => "dga_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # Check if required udm validation fields for NETWORK_DNS exist, if not set as NETWORK_UNCATEGORIZED.
    if [principal_present] == "true" and ![query_not_found] {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DNS"
        }
      }
    }
    else if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # DNP3
  else if [_path] == "dnp3" {

    # UDM > About
    mutate {
      replace => {
        "fc_request_labels.value" => "%{fc_request}"
      }
      on_error => "fc_request_not_found"
    }
    if ![fc_request_not_found] and [fc_request] != "" {
      mutate {
        replace => {
          "fc_request_labels.key" => "fc_request"
        }
      }
      mutate {
        merge => {
          "dnp3_about.labels" => "fc_request_labels"
        }
      }
    }

    mutate {
      replace => {
        "fc_reply_labels.value" => "%{fc_reply}"
      }
      on_error => "fc_reply_not_found"
    }
    if ![fc_reply_not_found] and [fc_reply] != "" {
      mutate {
        replace => {
          "fc_reply_labels.key" => "fc_reply"
        }
      }
      mutate {
        merge => {
          "dnp3_about.labels" => "fc_reply_labels"
        }
      }
    }

    mutate {
      convert => {
        "iin" => "string"
      }
      on_error => "iin_conversion_error"
    }

    mutate {
      replace => {
        "iin_labels.value" => "%{iin}"
      }
      on_error => "iin_not_found"
    }
    if ![iin_not_found] and [iin] != "" {
      mutate {
        replace => {
          "iin_labels.key" => "iin"
        }
      }
      mutate {
        merge => {
          "dnp3_about.labels" => "iin_labels"
        }
      }
    }

    mutate {
      merge => {
        "dnp3_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "dnp3_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # DPD
  else if [_path] == "dpd" {
    # UDM > Network
    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "analyzer_labels.value" => "%{analyzer}"
      }
      on_error => "analyzer_not_found"
    }
    if ![analyzer_not_found] and [analyzer] != "" {
      mutate {
        replace => {
          "analyzer_labels.key" => "analyzer"
        }
      }
      mutate {
        merge => {
          "dpd_about.labels" => "analyzer_labels"
        }
      }
    }

    mutate {
      replace => {
        "failure_reason_labels.value" => "%{failure_reason}"
      }
      on_error => "failure_reason_not_found"
    }
    if ![failure_reason_not_found] and [failure_reason] != "" {
      mutate {
        replace => {
          "failure_reason_labels.key" => "failure_reason"
        }
      }
      mutate {
        merge => {
          "dpd_about.labels" => "failure_reason_labels"
        }
      }
    }

    mutate {
      merge => {
        "dpd_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "dpd_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # ENCRYPTED_DNS
  else if [_path] == "encrypted_dns" {
    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "DNS"
      }
    }

    # UDM > Target
    grok {
      match => {
        "resp_h" => "%{IP:resp_h}"
      }
      overwrite => ["resp_h"]
      on_error => "resp_h_not_found"
    }
    if ![resp_h_not_found] {
      mutate {
        merge => {
          "token_target.ip" => "resp_h"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    # UDM > Network

    mutate {
      replace => {
        "token_network.tls.client.server_name" => "%{sni}"
      }
      on_error => "sni_not_found"
    }

    # UDM > About
    mutate {
      replace => {
        "cert_cn_labels.value" => "%{cert.cn}"
      }
      on_error => "cert_cn_not_found"
    }
    if ![cert_cn_not_found] and [cert][cn] != "" {
      mutate {
        replace => {
          "cert_cn_labels.key" => "cert_cn"
        }
      }
      mutate {
        merge => {
          "encrypted_dns_about.labels" => "cert_cn_labels"
        }
      }
    }

    mutate {
      replace => {
        "match_labels.value" => "%{match}"
      }
      on_error => "match_not_found"
    }
    if ![match_not_found] and [match] != "" {
      mutate {
        replace => {
          "match_labels.key" => "match"
        }
      }
      mutate {
        merge => {
          "encrypted_dns_about.labels" => "match_labels"
        }
      }
    }

    for san in cert.sans {
      mutate {
        replace => {
          "san_labels" => ""
        }
      }

      mutate {
        replace => {
          "san_labels.value" => "%{san}"
        }
        on_error => "san_not_found"
      }
      if ![san_not_found] and [san] != "" {
        mutate {
          replace => {
            "san_labels.key" => "cert_sans"
          }
        }
        mutate {
          merge => {
            "encrypted_dns_about.labels" => "san_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "encrypted_dns_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "encrypted_dns_about"
      }
      on_error => "failed_to_merge_about"
    }
  }

  # ----------------------------------------------------------------------
  # ENIP
  else if [_path] == "enip" {

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.process.command_line" => "%{command}"
      }
      on_error => "command_not_found"
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.session_id" => "%{session_handle}"
      }
      on_error => "session_handle_not_found"
    }

    # UDM > About
    mutate {
      convert => {
        "length" => "string"
      }
      on_error => "length_conversion_error"
    }

    mutate {
      replace => {
        "length_labels.value" => "%{length}"
      }
      on_error => "length_not_found"
    }
    if ![length_not_found] and [length] != "" {
      mutate {
        replace => {
          "length_labels.key" => "length"
        }
      }
      mutate {
        merge => {
          "enip_about.labels" => "length_labels"
        }
      }
    }

    mutate {
      replace => {
        "status_labels.value" => "%{status}"
      }
      on_error => "status_not_found"
    }
    if ![status_not_found] and [status] != "" {
      mutate {
        replace => {
          "status_labels.key" => "status"
        }
      }
      mutate {
        merge => {
          "enip_about.labels" => "status_labels"
        }
      }
    }

    mutate {
      replace => {
        "sender_context_labels.value" => "%{sender_context}"
      }
      on_error => "sender_context_not_found"
    }
    if ![sender_context_not_found] and [sender_context] != "" {
      mutate {
        replace => {
          "sender_context_labels.key" => "sender_context"
        }
      }
      mutate {
        merge => {
          "enip_about.labels" => "sender_context_labels"
        }
      }
    }

    mutate {
      replace => {
        "options_labels.value" => "%{options}"
      }
      on_error => "options_not_found"
    }
    if ![options_not_found] and [options] != "" {
      mutate {
        replace => {
          "options_labels.key" => "options"
        }
      }
      mutate {
        merge => {
          "enip_about.labels" => "options_labels"
        }
      }
    }

    mutate {
      merge => {
        "enip_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "enip_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "enip_command" => "string"
      }
      on_error => "enip_command_conversion_error"
    }

    mutate {
      replace => {
        "enip_command_label.value.string_value" => "%{enip_command}"
      }
      on_error => "enip_command_not_found"
    }

    if ![enip_command_not_found] and
      [enip_command_label][value][string_value] != "" {
      mutate {
        replace => {
          "enip_command_label.key" => "enip_command"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "enip_command_label"
        }
      }
    }

    mutate {
      convert => {
        "enip_command_code" => "string"
      }
      on_error => "enip_command_code_conversion_error"
    }

    mutate {
      replace => {
        "enip_command_code_label.value.string_value" =>
        "%{enip_command_code}"
      }
      on_error => "enip_command_code_not_found"
    }

    if ![enip_command_code_not_found] and
      [enip_command_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "enip_command_code_label.key" => "enip_command_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "enip_command_code_label"
        }
      }
    }

    mutate {
      convert => {
        "enip_status" => "string"
      }
      on_error => "enip_status_conversion_error"
    }

    mutate {
      replace => {
        "enip_status_label.value.string_value" => "%{enip_status}"
      }
      on_error => "enip_status_not_found"
    }

    if ![enip_status_not_found] and
      [enip_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "enip_status_label.key" => "enip_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "enip_status_label"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_label.value.string_value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }

    if ![is_orig_not_found] and
      [is_orig_label][value][string_value] != "" {
      mutate {
        replace => {
          "is_orig_label.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "is_orig_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # ENIP_DEBUG
  else if [_path] == "enip_debug" {
    # UDM > About
    mutate {
      replace => {
        "raw_data_labels.value" => "%{raw_data}"
      }
      on_error => "raw_data_not_found"
    }
    if ![raw_data_not_found] and [raw_data] != "" {
      mutate {
        replace => {
          "raw_data_labels.key" => "raw_data"
        }
      }
      mutate {
        merge => {
          "enip_debug_about.labels" => "raw_data_labels"
        }
      }
    }

    mutate {
      merge => {
        "enip_debug_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "enip_debug_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for STATUS_UPDATE exist.
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # ENIP_LIST_IDENTITY
  else if [_path] == "enip_list_identity" {
    # UDM > Target
    mutate {
      replace => {
        "device_type_labels.value" => "%{device_type}"
      }
      on_error => "device_type_not_found"
    }
    if ![device_type_not_found] and [device_type] != "" {
      mutate {
        replace => {
          "device_type_labels.key" => "device_type"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "device_type_labels"
        }
      }
    }

    mutate {
      replace => {
        "hardware.manufacturer" => "%{vendor}"
      }
      on_error => "vendor_not_found"
    }

    if ![vendor_not_found] and [vendor] != "" {
      mutate {
        merge => {
          "token_target.asset.hardware" => "hardware"
        }
      }
    }

    mutate {
      replace => {
        "product_name_labels.value" => "%{product_name}"
      }
      on_error => "product_name_not_found"
    }
    if ![product_name_not_found] and [product_name] != "" {
      mutate {
        replace => {
          "product_name_labels.key" => "product_name"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "product_name_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_target.asset.asset_id" => "CORELIGHT: %{serial_number}"
      }
      on_error => "serial_number_not_found"
    }

    mutate {
      convert => {
        "product_code" => "string"
      }
      on_error => "product_code_conversion_error"
    }

    mutate {
      replace => {
        "product_code_labels.value" => "%{product_code}"
      }
      on_error => "product_code_not_found"
    }
    if ![product_code_not_found] and [product_code] != "" {
      mutate {
        replace => {
          "product_code_labels.key" => "product_code"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "product_code_labels"
        }
      }
    }

    mutate {
      convert => {
        "revision" => "string"
      }
      on_error => "revision_conversion_error"
    }

    mutate {
      replace => {
        "revision_labels.value" => "%{revision}"
      }
      on_error => "revision_not_found"
    }
    if ![revision_not_found] and [revision] != "" {
      mutate {
        replace => {
          "revision_labels.key" => "revision"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "revision_labels"
        }
      }
    }

    mutate {
      replace => {
        "state_labels.value" => "%{state}"
      }
      on_error => "state_not_found"
    }
    if ![state_not_found] and [state] != "" {
      mutate {
        replace => {
          "state_labels.key" => "state"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "state_labels"
        }
      }
    }

    grok {
      match => {
        "device_ip" => "%{IP:device_ip}"
      }
      on_error => "ip_not_matched"
      overwrite => ["device_ip"]
    }

    if ![ip_not_matched] {
      mutate {
        merge => {
          "token_target.asset.ip" => "device_ip"
        }
      }

      # Duplicating the information to avoid "*events_go_proto.Event_Webproxy: invalid target device: device is empty" error.
      if [target_present] == "false" {
        mutate {
          merge => {
            "token_target.ip" => "device_ip"
          }
        }
      }
    }

    if ![ip_not_matched] or ![serial_number_not_found] {
      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "status_labels.value" => "%{status}"
      }
      on_error => "status_not_found"
    }
    if ![status_not_found] and [status] != "" {
      mutate {
        replace => {
          "status_labels.key" => "status"
        }
      }
      mutate {
        merge => {
          "identity_about.labels" => "status_labels"
        }
      }
    }

    mutate {
      merge => {
        "identity_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "identity_about"
      }
      on_error => "failed_to_merge_token_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # ETC_VIZ
  else if [_path] == "etc_viz" {

    # UDM > Target
    grok {
      match => {
        "server_a" => "%{IP:server_a}"
      }
      overwrite => ["server_a"]
      on_error => "ip_not_matched"
    }
    if ![ip_not_matched] {
      mutate {
        merge => {
          "token_target.ip" => "server_a"
        }
      }
    }

    mutate {
      convert => {
        "server_p" => "integer"
      }
      on_error => "server_p_conversion_error"
    }

    mutate {
      rename => {
        "server_p" => "token_target.port"
      }
    }

    for index,ele_service in service {
      if [index] == 0 {
        mutate {
          replace => {
            "token_target.application" => "%{ele_service}"
          }
          on_error => "ele_service_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "ele_service_labels" => ""
          }
        }

        mutate {
          replace => {
            "ele_service_labels.value" => "%{ele_service}"
          }
          on_error => "ele_service_not_found"
        }
        if ![ele_service_not_found] and [ele_service] != "" {
          mutate {
            replace => {
              "ele_service_labels.key" => "service"
            }
          }
          mutate {
            merge => {
              "token_target.labels" => "ele_service_labels"
            }
          }
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "viz_stat_labels.value" => "%{viz_stat}"
      }
      on_error => "viz_stat_not_found"
    }
    if ![viz_stat_not_found] and [viz_stat] != "" {
      mutate {
        replace => {
          "viz_stat_labels.key" => "viz_stat"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "viz_stat_labels"
        }
      }
    }

    mutate {
      convert => {
        "c2s_viz.size" => "string"
      }
      on_error => "c2s_viz_size_conversion_error"
    }

    mutate {
      replace => {
        "c2s_viz_size_labels.value" => "%{c2s_viz.size}"
      }
      on_error => "c2s_viz_size_not_found"
    }
    if ![c2s_viz_size_not_found] and [c2s_viz][size] != "" {
      mutate {
        replace => {
          "c2s_viz_size_labels.key" => "c2s_viz_size"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_size_labels"
        }
      }
    }

    mutate {
      convert => {
        "c2s_viz.enc_dev" => "string"
      }
      on_error => "c2s_viz_enc_dev_conversion_error"
    }

    mutate {
      replace => {
        "c2s_viz_enc_dev_labels.value" => "%{c2s_viz.enc_dev}"
      }
      on_error => "c2s_viz_enc_dev_not_found"
    }
    if ![c2s_viz_enc_dev_not_found] and [c2s_viz][enc_dev] != "" {
      mutate {
        replace => {
          "c2s_viz_enc_dev_labels.key" => "c2s_viz_enc_dev"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_enc_dev_labels"
        }
      }
    }

    mutate {
      convert => {
        "c2s_viz.enc_frac" => "string"
      }
      on_error => "c2s_viz_enc_frac_conversion_error"
    }

    mutate {
      replace => {
        "c2s_viz_enc_frac_labels.value" => "%{c2s_viz.enc_frac}"
      }
      on_error => "c2s_viz_enc_frac_not_found"
    }
    if ![c2s_viz_enc_frac_not_found] and [c2s_viz][enc_frac] != "" {
      mutate {
        replace => {
          "c2s_viz_enc_frac_labels.key" => "c2s_viz_enc_frac"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_enc_frac_labels"
        }
      }
    }

    mutate {
      convert => {
        "c2s_viz.pdu1_enc" => "string"
      }
      on_error => "c2s_viz_pdu1_enc_conversion_error"
    }

    mutate {
      replace => {
        "c2s_viz_pdu1_enc_labels.value" => "%{c2s_viz.pdu1_enc}"
      }
      on_error => "c2s_viz_pdu1_enc_not_found"
    }
    if ![c2s_viz_pdu1_enc_not_found] and [c2s_viz][pdu1_enc] != "" {
      mutate {
        replace => {
          "c2s_viz_pdu1_enc_labels.key" => "c2s_viz_pdu1_enc"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_pdu1_enc_labels"
        }
      }
    }

    mutate {
      convert => {
        "c2s_viz.clr_frac" => "string"
      }
      on_error => "c2s_viz_clr_frac_conversion_error"
    }

    mutate {
      replace => {
        "c2s_viz_clr_frac_labels.value" => "%{c2s_viz.clr_frac}"
      }
      on_error => "c2s_viz_clr_frac_not_found"
    }
    if ![c2s_viz_clr_frac_not_found] and [c2s_viz][clr_frac] != "" {
      mutate {
        replace => {
          "c2s_viz_clr_frac_labels.key" => "c2s_viz_clr_frac"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_clr_frac_labels"
        }
      }
    }

    mutate {
      replace => {
        "c2s_viz_clr_ex_labels.value" => "%{c2s_viz.clr_ex}"
      }
      on_error => "c2s_viz_clr_ex_not_found"
    }
    if ![c2s_viz_clr_ex_not_found] and [c2s_viz][clr_ex] != "" {
      mutate {
        replace => {
          "c2s_viz_clr_ex_labels.key" => "c2s_viz_clr_ex"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "c2s_viz_clr_ex_labels"
        }
      }
    }

    mutate {
      convert => {
        "s2c_viz.size" => "string"
      }
      on_error => "s2c_viz_size_conversion_error"
    }

    mutate {
      replace => {
        "s2c_viz_size_labels.value" => "%{s2c_viz.size}"
      }
      on_error => "s2c_viz_size_not_found"
    }
    if ![s2c_viz_size_not_found] and [s2c_viz][size] != "" {
      mutate {
        replace => {
          "s2c_viz_size_labels.key" => "s2c_viz_size"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_size_labels"
        }
      }
    }

    mutate {
      convert => {
        "s2c_viz.enc_dev" => "string"
      }
      on_error => "s2c_viz_enc_dev_conversion_error"
    }

    mutate {
      replace => {
        "s2c_viz_enc_dev_labels.value" => "%{s2c_viz.enc_dev}"
      }
      on_error => "s2c_viz_enc_dev_not_found"
    }
    if ![s2c_viz_enc_dev_not_found] and [s2c_viz][enc_dev] != "" {
      mutate {
        replace => {
          "s2c_viz_enc_dev_labels.key" => "s2c_viz_enc_dev"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_enc_dev_labels"
        }
      }
    }

    mutate {
      convert => {
        "s2c_viz.enc_frac" => "string"
      }
      on_error => "s2c_viz_enc_frac_conversion_error"
    }

    mutate {
      replace => {
        "s2c_viz_enc_frac_labels.value" => "%{s2c_viz.enc_frac}"
      }
      on_error => "s2c_viz_enc_frac_not_found"
    }
    if ![s2c_viz_enc_frac_not_found] and [s2c_viz][enc_frac] != "" {
      mutate {
        replace => {
          "s2c_viz_enc_frac_labels.key" => "s2c_viz_enc_frac"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_enc_frac_labels"
        }
      }
    }

    mutate {
      convert => {
        "s2c_viz.pdu1_enc" => "string"
      }
      on_error => "s2c_viz_pdu1_enc_conversion_error"
    }

    mutate {
      replace => {
        "s2c_viz_pdu1_enc_labels.value" => "%{s2c_viz.pdu1_enc}"
      }
      on_error => "s2c_viz_pdu1_enc_not_found"
    }
    if ![s2c_viz_pdu1_enc_not_found] and [s2c_viz][pdu1_enc] != "" {
      mutate {
        replace => {
          "s2c_viz_pdu1_enc_labels.key" => "s2c_viz_pdu1_enc"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_pdu1_enc_labels"
        }
      }
    }

    mutate {
      convert => {
        "s2c_viz.clr_frac" => "string"
      }
      on_error => "s2c_viz_clr_frac_conversion_error"
    }

    mutate {
      replace => {
        "s2c_viz_clr_frac_labels.value" => "%{s2c_viz.clr_frac}"
      }
      on_error => "s2c_viz_clr_frac_not_found"
    }
    if ![s2c_viz_clr_frac_not_found] and [s2c_viz][clr_frac] != "" {
      mutate {
        replace => {
          "s2c_viz_clr_frac_labels.key" => "s2c_viz_clr_frac"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_clr_frac_labels"
        }
      }
    }

    mutate {
      replace => {
        "s2c_viz_clr_ex_labels.value" => "%{s2c_viz.clr_ex}"
      }
      on_error => "s2c_viz_clr_ex_not_found"
    }
    if ![s2c_viz_clr_ex_not_found] and [s2c_viz][clr_ex] != "" {
      mutate {
        replace => {
          "s2c_viz_clr_ex_labels.key" => "s2c_viz_clr_ex"
        }
      }
      mutate {
        merge => {
          "etc_viz_about.labels" => "s2c_viz_clr_ex_labels"
        }
      }
    }

    mutate {
      merge => {
        "etc_viz_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "etc_viz_about"
      }
      on_error => "failed_to_merge_etc_viz"
    }
  }

  # ----------------------------------------------------------------------
  # FTP
  else if [_path] == "ftp" {
    # UDM > Principal
    mutate {
      replace => {
        "token_principal.user.user_display_name" => "%{user}"
      }
      on_error => "user_not_found"
    }

    grok {
      match => {
        "data_channel.orig_h" => "%{IP:orig_h}"
      }
      overwrite => ["orig_h"]
      on_error => "orig_h_not_found"
    }

    if ![orig_h_not_found] {
      mutate {
        merge => {
          "token_principal.ip" => "orig_h"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > Extention
    mutate {
      replace => {
        "token_extensions.auth.auth_details" => "%{password}"
      }
      on_error => "password_not_found"
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.ftp.command" => "%{command} %{arg}"
      }
      on_error => "command_not_found"
    }

    if [command_not_found] {
      mutate {
        replace => {
          "token_network.ftp.command" => "%{command}"
        }
        on_error => "command_not_found"
      }

      mutate {
        replace => {
          "token_network.ftp.command" => "%{arg}"
        }
        on_error => "arg_not_found"
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.file.mime_type" => "%{mime_type}"
      }
      on_error => "mime_type_not_found"
    }

    mutate {
      convert => {
        "file_size" => "uinteger"
      }
      on_error => "file_size_conversion_error"
    }

    mutate {
      rename => {
        "file_size" => "token_target.file.size"
      }
    }

    grok {
      match => {
        "data_channel.resp_h" => "%{IP:resp_h}"
      }
      overwrite => ["resp_h"]
      on_error => "resp_h_not_found"
    }

    if ![resp_h_not_found] {
      mutate {
        merge => {
          "token_target.ip" => "resp_h"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      convert => {
        "data_channel.resp_p" => "string"
      }
      on_error => "data_channel_resp_p_conversion_error"
    }

    mutate {
      replace => {
        "data_channel_resp_p_labels.value" => "%{data_channel.resp_p}"
      }
      on_error => "data_channel_resp_p_not_found"
    }
    if ![data_channel_resp_p_not_found] and [data_channel][resp_p] != "" {
      mutate {
        replace => {
          "data_channel_resp_p_labels.key" => "data_channel_resp_p"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "data_channel_resp_p_labels"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "reply_code" => "string"
      }
      on_error => "reply_code_conversion_error"
    }

    mutate {
      replace => {
        "reply_code_labels.value" => "%{reply_code}"
      }
      on_error => "reply_code_not_found"
    }
    if ![reply_code_not_found] and [reply_code] != "" {
      mutate {
        replace => {
          "reply_code_labels.key" => "reply_code"
        }
      }
      mutate {
        merge => {
          "ftp_about.labels" => "reply_code_labels"
        }
      }
    }

    mutate {
      replace => {
        "reply_msg_labels.value" => "%{reply_msg}"
      }
      on_error => "reply_msg_not_found"
    }
    if ![reply_msg_not_found] and [reply_msg] != "" {
      mutate {
        replace => {
          "reply_msg_labels.key" => "reply_msg"
        }
      }
      mutate {
        merge => {
          "ftp_about.labels" => "reply_msg_labels"
        }
      }
    }

    mutate {
      convert => {
        "data_channel.passive" => "string"
      }
      on_error => "data_channel_passive_conversion_error"
    }

    mutate {
      replace => {
        "data_channel_passive_labels.value" => "%{data_channel.passive}"
      }
      on_error => "data_channel_passive_not_found"
    }
    if ![data_channel_passive_not_found] and [data_channel][passive] != "" {
      mutate {
        replace => {
          "data_channel_passive_labels.key" => "data_channel_passive"
        }
      }
      mutate {
        merge => {
          "ftp_about.labels" => "data_channel_passive_labels"
        }
      }
    }

    mutate {
      replace => {
        "fuid_labels.value" => "%{fuid}"
      }
      on_error => "fuid_not_found"
    }
    if ![fuid_not_found] and [fuid] != "" {
      mutate {
        replace => {
          "fuid_labels.key" => "fuid"
        }
      }
      mutate {
        merge => {
          "ftp_about.labels" => "fuid_labels"
        }
      }
    }

    mutate {
      merge => {
        "ftp_about.labels" => "uid_labels"
      }
      on_error => "failed_to_merge_uid_labels"
    }

    mutate {
      merge => {
        "token_about" => "ftp_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_FTP exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and  [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_FTP"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # GENERIC_DNS_TUNNELS
  else if [_path] == "generic_dns_tunnels" {
    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "DNS"
      }
    }

    mutate {
      replace => {
        "token_network.dns_domain" => "%{domain}"
      }
      on_error => "domain_not_found"
    }

    mutate {
      replace => {
        "token_questions.name" => "%{domain}"
      }
      on_error => "domain_not_found"
    }

    mutate {
      merge => {
        "token_network.dns.questions" => "token_questions"
      }
      on_error => "questions_not_found"
    }

    # UDM > Principal
    grok {
      match => {
        "dns_client" => "%{IP:dns_client}"
      }
      overwrite => ["dns_client"]
      on_error => "dns_client_not_found"
    }
    if ![dns_client_not_found] {
      mutate {
        merge => {
          "token_principal.ip" => "dns_client"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "bytes" => "string"
      }
      on_error => "bytes_conversion_error"
    }

    mutate {
      replace => {
        "bytes_labels.value" => "%{bytes}"
      }
      on_error => "bytes_not_found"
    }
    if ![bytes_not_found] and [bytes] != "" {
      mutate {
        replace => {
          "bytes_labels.key" => "bytes"
        }
      }
      mutate {
        merge => {
          "generic_dns_tunnels_about.labels" => "bytes_labels"
        }
      }
    }

    mutate {
      convert => {
        "capture_secs" => "string"
      }
      on_error => "capture_secs_conversion_error"
    }

    mutate {
      replace => {
        "capture_secs_labels.value" => "%{capture_secs}"
      }
      on_error => "capture_secs_not_found"
    }
    if ![capture_secs_not_found] and [capture_secs] != "" {
      mutate {
        replace => {
          "capture_secs_labels.key" => "capture_secs"
        }
      }
      mutate {
        merge => {
          "generic_dns_tunnels_about.labels" => "capture_secs_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "generic_dns_tunnels_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_DNS exist.
    if [principal_present] == "true" and ![questions_not_found] {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DNS"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # GENERIC_ICMP_TUNNELS
  else if [_path] == "generic_icmp_tunnels" {
    # UDM > Network
    mutate {
      replace => {
        "token_network.ip_protocol" => "ICMP"
      }
    }

    # UDM > Principal
    grok {
      match => {
        "orig" => "%{IP:orig}"
      }
      overwrite => ["orig"]
      on_error => "orig_not_found"
    }
    if ![orig_not_found] {
      mutate {
        merge => {
          "token_principal.ip" => "orig"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > Target
    grok {
      match => {
        "resp" => "%{IP:resp}"
      }
      overwrite => ["resp"]
      on_error => "resp_not_found"
    }
    if ![resp_not_found] {
      mutate {
        merge => {
          "token_target.ip" => "resp"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    # UDM > Security Result
    mutate {
      replace => {
        "detection_labels.value" => "%{detection}"
      }
      on_error => "detection_not_found"
    }
    if ![detection_not_found] and [detection] != "" {
      mutate {
        replace => {
          "detection_labels.key" => "detection"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_security_result.detection_fields" =>
          "detection_labels"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "id" => "string"
      }
      on_error => "id_conversion_error"
    }

    mutate {
      replace => {
        "id_labels.value" => "%{id}"
      }
      on_error => "id_not_found"
    }
    if ![id_not_found] and [id] != "" {
      mutate {
        replace => {
          "id_labels.key" => "id"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_about.labels" => "id_labels"
        }
      }
    }

    mutate {
      convert => {
        "seq" => "string"
      }
      on_error => "seq_conversion_error"
    }

    mutate {
      replace => {
        "seq_labels.value" => "%{seq}"
      }
      on_error => "seq_not_found"
    }
    if ![seq_not_found] and [seq] != "" {
      mutate {
        replace => {
          "seq_labels.key" => "seq"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_about.labels" => "seq_labels"
        }
      }
    }

    mutate {
      convert => {
        "bytes" => "string"
      }
      on_error => "bytes_conversion_error"
    }

    mutate {
      replace => {
        "bytes_labels.value" => "%{bytes}"
      }
      on_error => "bytes_not_found"
    }
    if ![bytes_not_found] and [bytes] != "" {
      mutate {
        replace => {
          "bytes_labels.key" => "bytes"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_about.labels" => "bytes_labels"
        }
      }
    }

    mutate {
      convert => {
        "payload_len" => "string"
      }
      on_error => "payload_len_conversion_error"
    }

    mutate {
      replace => {
        "payload_len_labels.value" => "%{payload_len}"
      }
      on_error => "payload_len_not_found"
    }
    if ![payload_len_not_found] and [payload_len] != "" {
      mutate {
        replace => {
          "payload_len_labels.key" => "payload_len"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_about.labels" => "payload_len_labels"
        }
      }
    }

    mutate {
      replace => {
        "payload_labels.value" => "%{payload}"
      }
      on_error => "payload_not_found"
    }
    if ![payload_not_found] and [payload] != "" {
      mutate {
        replace => {
          "payload_labels.key" => "payload"
        }
      }
      mutate {
        merge => {
          "generic_icmp_tunnels_about.labels" => "payload_labels"
        }
      }
    }

    mutate {
      merge => {
        "generic_icmp_tunnels_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "generic_icmp_tunnels_about"
      }
      on_error => "failed_to_merge_about"
    }

    mutate {
      merge => {
        "token_security_result" => "generic_icmp_tunnels_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # ICMP_SPECIFIC_TUNNELS
  else if [_path] == "icmp_specific_tunnels" {
    # UDM > Network
    mutate {
      replace => {
        "token_network.ip_protocol" => "ICMP"
      }
    }

    mutate {
      convert => {
        "duration" => "integer"
      }
      on_error => "conversion_error"
    }
    if ![conversion_error] {
      mutate {
        rename => {
          "duration" => "token_network.session_duration.seconds"
        }
        on_error => "duration_not_found"
      }
    }

    # UDM > Intermediary
    mutate {
      replace => {
        "tunnel_labels.value" => "%{tunnel}"
      }
      on_error => "tunnel_not_found"
    }
    if ![tunnel_not_found] and [tunnel] != "" {
      mutate {
        replace => {
          "tunnel_labels.key" => "tunnel"
        }
      }
      mutate {
        merge => {
          "icmp_specific_tunnels_intermediary.labels" => "tunnel_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "icmp_specific_tunnels_intermediary"
      }
      on_error => "failed_to_merge_intermediary"
    }

    # UDM > About
    mutate {
      convert => {
        "start_time" => "string"
      }
      on_error => "start_time_conversion_error"
    }

    mutate {
      replace => {
        "start_time_labels.value" => "%{start_time}"
      }
      on_error => "start_time_not_found"
    }
    if ![start_time_not_found] and [start_time] != "" {
      mutate {
        replace => {
          "start_time_labels.key" => "start_time"
        }
      }
      mutate {
        merge => {
          "icmp_specific_tunnels_about.labels" => "start_time_labels"
        }
      }
    }

    mutate {
      convert => {
        "seq" => "string"
      }
      on_error => "seq_conversion_error"
    }

    mutate {
      replace => {
        "seq_labels.value" => "%{seq}"
      }
      on_error => "seq_not_found"
    }
    if ![seq_not_found] and [seq] != "" {
      mutate {
        replace => {
          "seq_labels.key" => "seq"
        }
      }
      mutate {
        merge => {
          "icmp_specific_tunnels_about.labels" => "seq_labels"
        }
      }
    }

    mutate {
      convert => {
        "icmp_id" => "string"
      }
      on_error => "icmp_id_conversion_error"
    }

    mutate {
      replace => {
        "icmp_id_labels.value" => "%{icmp_id}"
      }
      on_error => "icmp_id_not_found"
    }
    if ![icmp_id_not_found] and [icmp_id] != "" {
      mutate {
        replace => {
          "icmp_id_labels.key" => "icmp_id"
        }
      }
      mutate {
        merge => {
          "icmp_specific_tunnels_about.labels" => "icmp_id_labels"
        }
      }
    }

    mutate {
      replace => {
        "payload_labels.value" => "%{payload}"
      }
      on_error => "payload_not_found"
    }
    if ![payload_not_found] and [payload] != "" {
      mutate {
        replace => {
          "payload_labels.key" => "payload"
        }
      }
      mutate {
        merge => {
          "icmp_specific_tunnels_about.labels" => "payload_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "icmp_specific_tunnels_about"
      }
      on_error => "failed_merge_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # IPSEC
  else if [_path] == "ipsec" {
    # UDM > Principal
    mutate {
      replace => {
        "initiator_spi_labels.value" => "%{initiator_spi}"
      }
      on_error => "initiator_spi_not_found"
    }
    if ![initiator_spi_not_found] and [initiator_spi] != "" {
      mutate {
        replace => {
          "initiator_spi_labels.key" => "initiator_spi"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "initiator_spi_labels"
        }
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "responder_spi_labels.value" => "%{responder_spi}"
      }
      on_error => "responder_spi_not_found"
    }
    if ![responder_spi_not_found] and [responder_spi] != "" {
      mutate {
        replace => {
          "responder_spi_labels.key" => "responder_spi"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "responder_spi_labels"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "maj_ver" => "string"
      }
      on_error => "maj_ver_conversion_error"
    }

    mutate {
      replace => {
        "maj_ver_labels.value" => "%{maj_ver}"
      }
      on_error => "maj_ver_not_found"
    }
    if ![maj_ver_not_found] and [maj_ver] != "" {
      mutate {
        replace => {
          "maj_ver_labels.key" => "maj_ver"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "maj_ver_labels"
        }
      }
    }

    mutate {
      convert => {
        "min_ver" => "string"
      }
      on_error => "min_ver_conversion_error"
    }

    mutate {
      replace => {
        "min_ver_labels.value" => "%{min_ver}"
      }
      on_error => "min_ver_not_found"
    }
    if ![min_ver_not_found] and [min_ver] != "" {
      mutate {
        replace => {
          "min_ver_labels.key" => "min_ver"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "min_ver_labels"
        }
      }
    }

    mutate {
      convert => {
        "exchange_type" => "string"
      }
      on_error => "exchange_type_conversion_error"
    }

    mutate {
      replace => {
        "exchange_type_labels.value" => "%{exchange_type}"
      }
      on_error => "exchange_type_not_found"
    }
    if ![exchange_type_not_found] and [exchange_type] != "" {
      mutate {
        replace => {
          "exchange_type_labels.key" => "exchange_type"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "exchange_type_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_e" => "string"
      }
      on_error => "flag_e_conversion_error"
    }

    mutate {
      replace => {
        "flag_e_labels.value" => "%{flag_e}"
      }
      on_error => "flag_e_not_found"
    }
    if ![flag_e_not_found] and [flag_e] != "" {
      mutate {
        replace => {
          "flag_e_labels.key" => "flag_e"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_e_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_c" => "string"
      }
      on_error => "flag_c_conversion_error"
    }

    mutate {
      replace => {
        "flag_c_labels.value" => "%{flag_c}"
      }
      on_error => "flag_c_not_found"
    }
    if ![flag_c_not_found] and [flag_c] != "" {
      mutate {
        replace => {
          "flag_c_labels.key" => "flag_c"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_c_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_a" => "string"
      }
      on_error => "flag_a_conversion_error"
    }

    mutate {
      replace => {
        "flag_a_labels.value" => "%{flag_a}"
      }
      on_error => "flag_a_not_found"
    }
    if ![flag_a_not_found] and [flag_a] != "" {
      mutate {
        replace => {
          "flag_a_labels.key" => "flag_a"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_a_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_i" => "string"
      }
      on_error => "flag_i_conversion_error"
    }

    mutate {
      replace => {
        "flag_i_labels.value" => "%{flag_i}"
      }
      on_error => "flag_i_not_found"
    }
    if ![flag_i_not_found] and [flag_i] != "" {
      mutate {
        replace => {
          "flag_i_labels.key" => "flag_i"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_i_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_v" => "string"
      }
      on_error => "flag_v_conversion_error"
    }

    mutate {
      replace => {
        "flag_v_labels.value" => "%{flag_v}"
      }
      on_error => "flag_v_not_found"
    }
    if ![flag_v_not_found] and [flag_v] != "" {
      mutate {
        replace => {
          "flag_v_labels.key" => "flag_v"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_v_labels"
        }
      }
    }

    mutate {
      convert => {
        "flag_r" => "string"
      }
      on_error => "flag_r_conversion_error"
    }

    mutate {
      replace => {
        "flag_r_labels.value" => "%{flag_r}"
      }
      on_error => "flag_r_not_found"
    }
    if ![flag_r_not_found] and [flag_r] != "" {
      mutate {
        replace => {
          "flag_r_labels.key" => "flag_r"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "flag_r_labels"
        }
      }
    }

    mutate {
      convert => {
        "message_id" => "string"
      }
      on_error => "message_id_conversion_error"
    }

    mutate {
      replace => {
        "message_id_labels.value" => "%{message_id}"
      }
      on_error => "message_id_not_found"
    }
    if ![message_id_not_found] and [message_id] != "" {
      mutate {
        replace => {
          "message_id_labels.key" => "message_id"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "message_id_labels"
        }
      }
    }

    for vendorid in vendor_ids {
      mutate {
        replace => {
          "vendorid_labels" => ""
        }
      }

      mutate {
        replace => {
          "vendorid_labels.value" => "%{vendorid}"
        }
        on_error => "vendorid_not_found"
      }
      if ![vendorid_not_found] and [vendorid] != "" {
        mutate {
          replace => {
            "vendorid_labels.key" => "vendor_id"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "vendorid_labels"
          }
        }
      }
    }

    for notifymessage in notify_messages {
      mutate {
        replace => {
          "notifymessage_labels" => ""
        }
      }

      mutate {
        replace => {
          "notifymessage_labels.value" => "%{notifymessage}"
        }
        on_error => "notifymessage_not_found"
      }
      if ![notifymessage_not_found] and [notifymessage] != "" {
        mutate {
          replace => {
            "notifymessage_labels.key" => "notify_message"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "notifymessage_labels"
          }
        }
      }
    }

    for transform in transforms {
      mutate {
        replace => {
          "transform_labels" => ""
        }
      }

      mutate {
        replace => {
          "transform_labels.value" => "%{transform}"
        }
        on_error => "transform_not_found"
      }
      if ![transform_not_found] and [transform] != "" {
        mutate {
          replace => {
            "transform_labels.key" => "transform"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "transform_labels"
          }
        }
      }
    }

    for dhgroup in ke_dh_groups {
      mutate {
        replace => {
          "dhgroup_labels" => ""
        }
      }

      mutate {
        convert => {
          "dhgroup" => "string"
        }
        on_error => "failed_to_convert_dhgroup"
      }

      mutate {
        replace => {
          "dhgroup_labels.value" => "%{dhgroup}"
        }
        on_error => "dhgroup_not_found"
      }
      if ![dhgroup_not_found] and [dhgroup] != "" {
        mutate {
          replace => {
            "dhgroup_labels.key" => "ke_dh_group"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "dhgroup_labels"
          }
        }
      }
    }

    for proposal in proposals {
      mutate {
        replace => {
          "proposal_labels" => ""
        }
      }

      mutate {
        convert => {
          "proposal" => "string"
        }
        on_error => "failed_to_convert_proposal"
      }

      mutate {
        replace => {
          "proposal_labels.value" => "%{proposal}"
        }
        on_error => "proposal_not_found"
      }
      if ![proposal_not_found] and [proposal] != "" {
        mutate {
          replace => {
            "proposal_labels.key" => "proposal"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "proposal_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "protocol_id" => "string"
      }
      on_error => "protocol_id_conversion_error"
    }

    mutate {
      replace => {
        "protocol_id_labels.value" => "%{protocol_id}"
      }
      on_error => "protocol_id_not_found"
    }
    if ![protocol_id_not_found] and [protocol_id] != "" {
      mutate {
        replace => {
          "protocol_id_labels.key" => "protocol_id"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "protocol_id_labels"
        }
      }
    }

    for certificate in certificates {
      mutate {
        replace => {
          "certificate_labels" => ""
        }
      }

      mutate {
        replace => {
          "certificate_labels.value" => "%{certificate}"
        }
        on_error => "certificate_not_found"
      }
      if ![certificate_not_found] and [certificate] != "" {
        mutate {
          replace => {
            "certificate_labels.key" => "certificate"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "certificate_labels"
          }
        }
      }
    }

    for transformattribute in transform_attributes {
      mutate {
        replace => {
          "transformattribute_labels" => ""
        }
      }

      mutate {
        replace => {
          "transformattribute_labels.value" => "%{transformattribute}"
        }
        on_error => "transformattribute_not_found"
      }
      if ![transformattribute_not_found] and [transformattribute] != "" {
        mutate {
          replace => {
            "transformattribute_labels.key" => "transform_attribute"
          }
        }
        mutate {
          merge => {
            "ipsec_about.labels" => "transformattribute_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "length" => "string"
      }
      on_error => "length_conversion_error"
    }

    mutate {
      replace => {
        "length_labels.value" => "%{length}"
      }
      on_error => "length_not_found"
    }
    if ![length_not_found] and [length] != "" {
      mutate {
        replace => {
          "length_labels.key" => "length"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "length_labels"
        }
      }
    }

    mutate {
      replace => {
        "hash_labels.value" => "%{hash}"
      }
      on_error => "hash_not_found"
    }
    if ![hash_not_found] and [hash] != "" {
      mutate {
        replace => {
          "hash_labels.key" => "hash"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "hash_labels"
        }
      }
    }

    mutate {
      convert => {
        "doi" => "string"
      }
      on_error => "doi_conversion_error"
    }

    mutate {
      replace => {
        "doi_labels.value" => "%{doi}"
      }
      on_error => "doi_not_found"
    }
    if ![doi_not_found] and [doi] != "" {
      mutate {
        replace => {
          "doi_labels.key" => "doi"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "doi_labels"
        }
      }
    }

    mutate {
      replace => {
        "situation_labels.value" => "%{situation}"
      }
      on_error => "situation_not_found"
    }
    if ![situation_not_found] and [situation] != "" {
      mutate {
        replace => {
          "situation_labels.key" => "situation"
        }
      }
      mutate {
        merge => {
          "ipsec_about.labels" => "situation_labels"
        }
      }
    }

    mutate {
      merge => {
        "ipsec_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "ipsec_about"
      }
      on_error => "failed_to_merge_about"
    }

    # UDM > additional
    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_label.value.string_value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }

    if ![is_orig_not_found] and
      [is_orig_label][value][string_value] != "" {
      mutate {
        replace => {
          "is_orig_label.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "is_orig_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SYSLOG
  else if [_path] == "syslog" {

    # UDM > Network
    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {

      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "facility_labels.value" => "%{facility}"
      }
      on_error => "facility_not_found"
    }
    if ![facility_not_found] and [facility] != "" {
      mutate {
        replace => {
          "facility_labels.key" => "facility"
        }
      }
      mutate {
        merge => {
          "syslog_about.labels" => "facility_labels"
        }
      }
    }

    mutate {
      replace => {
        "severity_labels.value" => "%{severity}"
      }
      on_error => "severity_not_found"
    }
    if ![severity_not_found] and [severity] != "" {
      mutate {
        replace => {
          "severity_labels.key" => "severity"
        }
      }
      mutate {
        merge => {
          "syslog_about.labels" => "severity_labels"
        }
      }
    }

    # UDM > Metadata
    mutate {
      replace => {
        "token_metadata.description" => "%{message}"
      }
      on_error => "message_not_found"
    }

    mutate {
      merge => {
        "syslog_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "syslog_about"
      }
      on_error => "failed_to_merge_about"
    }

    mutate {
      merge => {
        "token_security_result" => "syslog_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # Check if required udm validation fields for STATUS_UPDATE exist.
    if [principal_present] == "true" {
      # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
      # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled
      mutate {
        replace => {
          "token_principal.hostname" => "%{id.orig_h}"
        }
        on_error => "id_orig_h_not_found"
      }
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # TDS
  else if [_path] == "tds" {

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.process.command_line" => "%{command}"
      }
      on_error => "command_not_found"
    }

    # UDM > About
    mutate {
      merge => {
        "tds_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "tds_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # TDS_RPC
  else if [_path] == "tds_rpc" {
    # UDM > About
    mutate {
      replace => {
        "procedure_name_labels.value" => "%{procedure_name}"
      }
      on_error => "procedure_name_not_found"
    }
    if ![procedure_name_not_found] and [procedure_name] != "" {
      mutate {
        replace => {
          "procedure_name_labels.key" => "procedure_name"
        }
      }
      mutate {
        merge => {
          "tds_rpc_about.labels" => "procedure_name_labels"
        }
      }
    }

    for parameter in parameters {
      mutate {
        replace => {
          "parameter_labels" => ""
        }
      }

      mutate {
        replace => {
          "parameter_labels.value" => "%{parameter}"
        }
        on_error => "parameter_not_found"
      }
      if ![parameter_not_found] and [parameter] != "" {
        mutate {
          replace => {
            "parameter_labels.key" => "parameter"
          }
        }
        mutate {
          merge => {
            "tds_rpc_about.labels" => "parameter_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "tds_rpc_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "tds_rpc_about"
      }
      on_error => "failed_to_merge_about"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE.
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # SURICATA_EVE
  else if [_path] == "suricata_eve" {

    mutate {
      replace => {
        "event_type" => ""
      }
    }

    mutate {
      replace => {
        "token_metadata.event_type" => "NETWORK_CONNECTION"
      }
    }

    # Parse JSON log
    json {
      on_error => "not_json"
      source => "raw_alert"
      array_function => "split_columns"
    }

    if [not_json] {
      drop {
        tag => "TAG_MALFORMED_MESSAGE"
      }
    }

    # Drop stats and poststats, no security value -  low level packet capture stat logs
    if [event_type] =~ "stats" {
      drop {
        tag => "TAG_NO_SECURITY_VALUE"
      }
    }

    ################################
    # Global Values
    ################################

    # UDM > Metadata
    mutate {
      replace => {
        "token_metadata.product_name" => "Suricata"
      }
    }

    ################################
    # HTTP specific
    ################################
    #
    if [event_type] == "http" {

      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_HTTP"
          "token_network.application_protocol" => "HTTP"
        }
      }
      mutate {
        replace => {
          "token_target.hostname" => "%{http.hostname}"
        }
        on_error => "hostname_not_found"
      }
      if ![hostname_not_found] {
        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
      mutate {
        replace => {
          "token_network.http.user_agent" => "%{http.http_user_agent}"
        }
        on_error => "user_agent_not_found"
      }
      mutate {
        replace => {
          "token_network.http.method" => "%{http.http_method}"
        }
        on_error => "http_method_not_found"
      }
      mutate {
        rename => {
          "http.length" => "token_network.received_bytes"
          "http.status" => "token_network.http.response_code"
        }
        on_error => "failed_to_rename"
      }
      mutate {
        convert => {
          "token_network.received_bytes" => "uinteger"
        }
        on_error => "failed_to_convert"
      }
      mutate {
        convert => {
          "token_network.http.response_code" => "integer"
        }
        on_error => "failed_to_convert"
      }

      mutate {
        convert => {
          "dest_port" => "string"
        }
        on_error => "conversion_error"
      }
      mutate {
        replace => {
          "dest_port_str" => "%{dest_port}"
        }
        on_error => "dest_port_not_found"
      }

      if ![dest_port_not_found] {
        if [dest_port] == "80" {
          mutate {
            replace => {
              "token_target.url" => "http://%{http.hostname}%{http.url}"
            }
            on_error => "url_not_found"
          }
        }
        else {
          mutate {
            replace => {
              "token_target.url" =>
              "http://%{http.hostname}:%{dest_port_str}%{http.url}"
            }
            on_error => "url_not_found"
          }
        }
      }

      # HTTP referral is optional, so check if it's in the raw message
      mutate {
        replace => {
          "token_network.http.referral_url" => "%{http.http_refer}"
        }
        on_error => "url_not_found"
      }
    }
    # End http

    ################################
    # Event_type 'dns' specific
    ################################
    #
    # Only support for single dns suricata data, not grouped/detailed
    # grouped/detailed does work with this config, but the additional data is not parsed into the UDM
    # Only 9 most common dns record types supported
    # Only 9 most common dns response codes supported
    # Full list here http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml

    if [event_type] == "dns" {
      mutate {
        replace => {
          "questions_present" => "false"
        }
      }
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DNS"
        }
      }
      mutate {
        convert => {
          "dns.id" => "string"
        }
        on_error => "failed_to_convert_dns_id"
      }

      mutate {
        replace => {
          "token_network.application_protocol" => "DNS"
        }
      }
      mutate {
        replace => {
          "token_network.dns.id" => "%{dns.id}"
        }
        on_error => "dns_id_not_found"
      }

      mutate {
        replace => {
          "dns.rrtype" => "%{dns.rrtype}"
        }
        on_error => "dns_rrtype_not_found"
      }
      if ![dns_rrtype_not_found] {
        if [dns][rrtype] == "A" {
          mutate {
            replace => {
              "dns.rrtype" => "1"
            }
          }
        }
        else if [dns][rrtype] == "AAAA" {
          mutate {
            replace => {
              "dns.rrtype" => "28"
            }
          }
        }
        else if [dns][rrtype] == "CNAME" {
          mutate {
            replace => {
              "dns.rrtype" => "5"
            }
          }
        }
        else if [dns][rrtype] == "MX" {
          mutate {
            replace => {
              "dns.rrtype" => "15"
            }
          }
        }
        else if [dns][rrtype] == "NS" {
          mutate {
            replace => {
              "dns.rrtype" => "2"
            }
          }
        }
        else if [dns][rrtype] == "PTR" {
          mutate {
            replace => {
              "dns.rrtype" => "12"
            }
          }
        }
        else if [dns][rrtype] == "SOA" {
          mutate {
            replace => {
              "dns.rrtype" => "6"
            }
          }
        }
        else if [dns][rrtype] == "SRV" {
          mutate {
            replace => {
              "dns.rrtype" => "33"
            }
          }
        }
        else if [dns][rrtype] == "TXT" {
          mutate {
            replace => {
              "dns.rrtype" => "16"
            }
          }
        }
        else {
          mutate {
            replace => {
              "dns.rrtype" => "0"
            }
          }
        }
      }

      mutate {
        replace => {
          "dns.type" => "%{dns.type}"
        }
        on_error => "query_not_found"
      }
      if ![query_not_found] {
        if [dns][type] == "query" {
          mutate {
            replace => {
              "token_network.dns.response" => "false"
            }
          }
          mutate {
            convert => {
              "token_network.dns.response" => "boolean"
            }
          }
          mutate {
            replace => {
              "dns_question.name" => "%{dns.rrname}"
            }
            on_error => "rrname_not_found"
          }
          mutate {
            replace => {
              "dns_question.type" => "%{dns.rrtype}"
            }
            on_error => "rrtype_not_found"
          }
          mutate {
            convert => {
              "dns_question.type" => "uinteger"
            }
            on_error => "coversion_error"
          }
          mutate {
            merge => {
              "token_network.dns.questions" => "dns_question"
            }
            on_error => "merge_error"
          }
          if ![merge_error] {
            mutate {
              replace => {
                "questions_present" => "true"
              }
            }
          }
        }
        if [dns][type] == "answer" {
          mutate {
            replace => {
              "dns.rd" => "%{dns.rd}"
            }
            on_error => "dns_rd_not_found"
          }
          if ![dns_rd_not_found] {
            if [dns][rd] == "true" {
              mutate {
                replace => {
                  "dns.rd" = "true"
                }
              }
            }
            else {
              mutate {
                replace => {
                  "dns.rd" = "false"
                }
              }
            }
          }
          mutate {
            replace => {
              "dns.ra" => "%{dns.ra}"
            }
            on_error => "dns_ra_not_found"
          }
          if ![dns_ra_not_found] {
            if [dns][ra] == "true" {
              mutate {
                replace => {
                  "dns.ra" = "true"
                }
              }
            }
            else {
              mutate {
                replace => {
                  "dns.ra" = "false"
                }
              }
            }
          }
          mutate {
            replace => {
              "dns.aa" => "%{dns.aa}"
            }
            on_error => "dns_aa_not_found"
          }
          if ![dns_aa_not_found] {
            if [dns][aa] == "true" {
              mutate {
                replace => {
                  "dns.aa" = "true"
                }
              }
            }
            else {
              mutate {
                replace => {
                  "dns.aa" = "false"
                }
              }
            }
          }
          mutate {
            replace => {
              "dns.tc" => "%{dns.tc}"
            }
            on_error => "dns_tc_not_found"
          }
          if ![dns_tc_not_found] {
            if [dns][tc] == "true" {
              mutate {
                replace => {
                  "dns.tc" = "true"
                }
              }
            }
            else {
              mutate {
                replace => {
                  "dns.tc" = "false"
                }
              }
            }
          }
          mutate {
            replace => {
              "dns.rcode" => "%{dns.rcode}"
            }
            on_error => "dns_rcode_not_found"
          }
          if ![dns_rcode_not_found] {
            if [dns][rcode] == "NOERROR" {
              mutate {
                replace => {
                  "dns.rcode" = "0"
                }
              }
            }
            else if [dns][rcode] == "FORMERR" {
              mutate {
                replace => {
                  "dns.rcode" = "1"
                }
              }
            }
            else if [dns][rcode] == "SERVFAIL" {
              mutate {
                replace => {
                  "dns.rcode" = "2"
                }
              }
            }
            else if [dns][rcode] == "NXDOMAIN" {
              mutate {
                replace => {
                  "dns.rcode" = "3"
                }
              }
            }
            else if [dns][rcode] == "NOTIMP" {
              mutate {
                replace => {
                  "dns.rcode" = "4"
                }
              }
            }
            else if [dns][rcode] == "REFUSED" {
              mutate {
                replace => {
                  "dns.rcode" = "5"
                }
              }
            }
            else if [dns][rcode] == "YXDOMAIN" {
              mutate {
                replace => {
                  "dns.rcode" = "6"
                }
              }
            }
            else if [dns][rcode] == "XRRSET" {
              mutate {
                replace => {
                  "dns.rcode" = "7"
                }
              }
            }
            else if [dns][rcode] == "NOTAUTH" {
              mutate {
                replace => {
                  "dns.rcode" = "8"
                }
              }
            }
            else if [dns][rcode] == "NOTZONE" {
              mutate {
                replace => {
                  "dns.rcode" = "9"
                }
              }
            }
            else {
              mutate {
                replace => {
                  "dns.rcode" = "999"
                }
              }
            }
          }
          mutate {
            replace => {
              "tokne_network.dns.response" => "true"
            }
          }
          mutate {
            replace => {
              "dns_answers.resourcerecord.name" => "%{dns.rrname}"
            }
            on_error => "rrname_not_found"
          }
          mutate {
            replace => {
              "dns_answers.resourcerecord.type" => "%{dns.rrtype}"
            }
            on_error => "rrtype_not_found"
          }
          mutate {
            replace => {
              "dns_answers.resourcerecord.data" => "%{dns.rdata}"
            }
            on_error => "rdata_not_found"
          }
          mutate {
            replace => {
              "token_network.dns.response_code" => "%{dns.rcode}"
            }
            on_error => "rcode_not_found"
          }
          mutate {
            replace => {
              "token_network.dns.authoritative" => "%{dns.aa}"
            }
            on_error => "aa_not_found"
          }
          mutate {
            replace => {
              "token_network.dns.truncated" => "%{dns.tc}"
            }
            on_error => "tc_not_found"
          }
          mutate {
            replace => {
              "token_network.dns.recursion_desired" => "%{dns.rd}"
            }
            on_error => "rd_not_found"
          }
          mutate {
            replace => {
              "token_network.dns.recursion_available" => "%{dns.ra}"
            }
            on_error => "ra_not_found"
          }
          mutate {
            replace => {
              "dns_question.name" => "%{dns.rrname}"
            }
            on_error => "rrname_not_found"
          }
          mutate {
            replace => {
              "dns_question.type" => "%{dns.rrtype}"
            }
            on_error => "rrtype_not_found"
          }
          # Dns ttl isn't always present
          mutate {
            replace => {
              "dns_answers.resourcerecord.ttl" => "%{dns.ttl}"
            }
            on_error => "dns_ttl_not_found"
          }
          mutate {
            convert => {
              "token_network.dns.recursion_desired" => "boolean"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "token_network.dns.recursion_available" => "boolean"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "token_network.dns.truncated" => "boolean"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "token_network.dns.authoritative" => "boolean"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "dns_answers.resourcerecord.type" => "uinteger"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "dns_question.type" => "uinteger"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "token_network.dns.response_code" => "uinteger"
            }
            on_error => "conversion_error"
          }
          mutate {
            convert => {
              "dns_answers.resourcerecord.ttl" => "uinteger"
            }
            on_error => "conversion_error"
          }
          mutate {
            merge => {
              "token_network.dns.questions" => "dns_question"
            }
            on_error => "failed_to_merge"
          }
          if ![failed_to_merge] {
            mutate {
              replace => {
                "questions_present" => "true"
              }
            }
          }
          mutate {
            merge => {
              "token_network.dns.answers" => "dns_answers.resourcerecord"
            }
            on_error => "failed_to_merge"
          }
        }
      }
      mutate {
        convert => {
          "token_network.dns.id" => "uinteger"
        }
        on_error => "failed_to_convert_responce"
      }
      mutate {
        convert => {
          "token_network.dns.response" => "boolean"
        }
        on_error => "failed_to_convert_responce"
      }
    }

    ################################
    # Event_type 'alert' specific
    ################################
    if [event_type] == "alert" {

      mutate {
        replace => {
          "token_metadata.event_type" => "SCAN_NETWORK"
        }
      }
      mutate {
        convert => {
          "alert.signature_id" => "string"
        }
        on_error => "failed_to_convert_signature_di"
      }

      mutate {
        replace => {
          "eve_security_result.rule_id" => "%{alert.signature_id}"
        }
        on_error => "id_not_found"
      }

      mutate {
        replace => {
          "eve_security_result.rule_name" => "%{alert.signature}"
        }
        on_error => "signature_not_found"
      }

      mutate {
        replace => {
          "eve_security_result.summary" => "%{alert.signature}"
        }
        on_error => "category_not_found"
      }

      mutate {
        replace => {
          "alert.category" => "%{alert.category}"
        }
        on_error => "category_not_found"
      }
      if ![category_not_found] {
        if [alert][category] in ["Misc Attack",
        "Device Retrieving External IP Address Detected",
        "Potentially Bad Traffic", "Targeted Malicious Activity was Detected",
        "A suspicious string was detected"] {
          mutate {
            replace => {
              "sr_category" => "NETWORK_MALICIOUS"
            }
          }
        }
        else if [alert][category] in ["Not Suspicious Traffic",
        "Misc activity","Unknown Traffic"] {
          mutate {
            replace => {
              "sr_category" => "NETWORK_SUSPICIOUS"
            }
          }
        }
        else if [alert][category] in ["Attempted User Privilege Gain",
        "Attempted Administrator Privilege Gain", "Web Application Attack"] {
          mutate {
            replace => {
              "sr_category" => "EXPLOIT"
            }
          }
        }
        else if [alert][category] == "Potential Corporate Privacy Violation" {
          mutate {
            replace => {
              "sr_category" => "POLICY_VIOLATION"
            }
          }
        }
        else if [alert][category] == "A Network Trojan was detected" {
          mutate {
            replace => {
              "sr_category" => "NETWORK_COMMAND_AND_CONTROL"
            }
          }
        }
        else if [alert][category] == "Attempted Information Leak" {
          mutate {
            replace => {
              "sr_category" => "DATA_EXFILTRATION"
            }
          }
        }
        else if [alert][category] in
        ["access to a potentially vulnerable web application",
        "Detection of a Network Scan"] {
          mutate {
            replace => {
              "sr_category" => "NETWORK_RECON"
            }
          }
        }
        else {
          mutate {
            replace => {
              "sr_category" => "UNKNOWN_CATEGORY"
            }
          }
        }
        mutate {
          merge => {
            "eve_security_result.category_details" => "alert.category"
          }
        }
      }

      mutate {
        convert => {
          "alert.severity" => "string"
        }
        on_error => "failed_to_convert_severity"
      }

      mutate {
        replace => {
          "alert.severity" => "%{alert.severity}"
        }
        on_error => "severity_not_found"
      }

      if ![severity_not_found] {
        if [alert][severity] == "1" {
          mutate {
            replace => {
              "eve_security_result.priority" => "PRIORITY_CRITICAL"
              "eve_security_result.severity" => "CRITICAL"
            }
          }
        }
        else if [alert][severity] == "2" {
          mutate {
            replace => {
              "eve_security_result.priority" => "HIGH_PRIORITY"
              "eve_security_result.severity" => "HIGH"
            }
          }
        }
        else if [alert][severity] == "3" {
          mutate {
            replace => {
              "eve_security_result.priority" => "MEDIUM_PRIORITY"
              "eve_security_result.severity" => "MEDIUM"
            }
          }
        }
        else if [alert][severity] == "4" {
          mutate {
            replace => {
              "eve_security_result.priority" => "LOW_PRIORITY"
              "eve_security_result.severity" => "LOW"
            }
          }
        }
        mutate {
          replace => {
            "eve_security_result.severity_details" => "%{alert.severity}"
          }
        }
      }

      mutate {
        replace => {
          "alert.action" => "%{alert.action}"
        }
        on_error => "action_not_found"
      }

      if ![action_not_found] {
        if [alert][action] == "allowed" {
          mutate {
            replace => {
              "sr_action" => "ALLOW"
            }
          }
        }
        else if [alert][action] == "drop" or [alert][action] == "reject" {
          mutate {
            replace => {
              "sr_action" => "BLOCK"
            }
          }
        }
        else {
          mutate {
            replace => {
              "sr_action" => "UNKNOWN_ACTION"
            }
          }
        }
        mutate {
          replace => {
            "eve_security_result.action_details" => "%{alert.action}"
          }
        }
      }

      mutate {
        merge => {
          "eve_security_result.category" => "sr_category"
        }
        on_error => "failed_to_merge"
      }
      mutate {
        merge => {
          "eve_security_result.action" => "sr_action"
        }
        on_error => "failed_to_merge"
      }

      # Tuning ACE
      mutate {
        replace => {
          "payload_labels.value" => "%{payload}"
        }
        on_error => "payload_not_found"
      }
      if ![payload_not_found] and [payload] != "" {
        mutate {
          replace => {
            "payload_labels.key" => "payload"
          }
        }
        mutate {
          merge => {
            "suricata_eve_about.labels" => "payload_labels"
          }
        }
      }

      mutate {
        merge => {
          "token_about" => "suricata_eve_about"
        }
        on_error => "failed_to_merge_suricata_about"
      }

      mutate {
        replace => {
          "in_iface_label.value" => "%{in_iface}"
        }
        on_error => "in_iface_not_found"
      }
      if ![in_iface_not_found] and [in_iface] != "" {
        mutate {
          replace => {
            "in_iface_label.key" => "in_iface"
          }
        }
        mutate {
          merge => {
            "eve_security_result.rule_labels" => "in_iface_label"
          }
        }
      }

      if [raw_alert] =~ "vlan.*" {
        mutate {
          convert => {
            "vlan.0" => "string"
          }
          on_error => "conversion_erro"
        }

        mutate {
          replace => {
            "vlan" => "%{vlan.0}"
          }
          on_error => "vlan_not_found"
        }

        mutate {
          convert => {
            "vlan" => "string"
          }
          on_error => "already_string"
        }
        mutate {
          replace => {
            "vlan_label.value" => "%{vlan}"
          }
          on_error => "no_vlan_label"
        }
        if ![no_vlan_label] and [vlan] != "" {
          mutate {
            replace => {
              "vlan_label.key" => "vlan"
            }
          }
          mutate {
            merge => {
              "eve_intermediary.labels" => "vlan_label"
            }
          }
        }
      }
      mutate {
        replace => {
          "token_network.community_id" => "%{community_id}"
        }
        on_error => "community_id_not_found"
      }

      mutate {
        convert => {
          "alert.gid" => "string"
        }
        on_error => "already_string"
      }

      mutate {
        replace => {
          "gid_label.value" => "%{alert.gid}"
        }
        on_error => "alert_gid_not_found"
      }

      if ![alert_gid_not_found] and [alert][gid] != "" {
        mutate {
          replace => {
            "gid_label.key" => "alert_gid"
          }
        }
        mutate {
          merge => {
            "eve_security_result.detection_fields" => "gid_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.rev" => "string"
        }
        on_error => "already_string"
      }

      mutate {
        replace => {
          "rev_label.value" => "%{alert.rev}"
        }
        on_error => "alert_rev_not_found"
      }
      if ![alert_rev_not_found] and [alert][rev] != "" {
        mutate {
          replace => {
            "rev_label.key" => "alert_rev"
          }
        }
        mutate {
          merge => {
            "eve_security_result.detection_fields" => "rev_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.updated_at.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "updated_at_label.value" => "%{alert.metadata.updated_at.0}"
        }
        on_error => "no_updated_at_label"
      }
      if ![no_updated_at_label] and [alert][metadata][updated_at][0] != "" {
        mutate {
          replace => {
            "updated_at_label.key" => "updated_at"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "updated_at_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.created_at.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "created_at_label.value" => "%{alert.metadata.created_at.0}"
        }
        on_error => "no_created_at_label"
      }
      if ![no_created_at_label] and [alert][metadata][created_at][0] != "" {
        mutate {
          replace => {
            "created_at_label.key" => "created_at"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "created_at_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.affected_product.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "affected_product_label.value" =>
          "%{alert.metadata.affected_product.0}"
        }
        on_error => "no_affected_product_label"
      }
      if ![no_affected_product_label]
      and [alert][metadata][affected_product][0] != "" {
        mutate {
          replace => {
            "affected_product_label.key" => "affected_product"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "affected_product_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.attack_target.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "attack_target_label.value" => "%{alert.metadata.attack_target.0}"
        }
        on_error => "no_attack_target_label"
      }
      if ![no_attack_target_label]
      and [alert][metadata][attack_target][0] != "" {
        mutate {
          replace => {
            "attack_target_label.key" => "attack_target"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "attack_target_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.deployment.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "deployment_label.value" => "%{alert.metadata.deployment.0}"
        }
        on_error => "no_deployment_label"
      }
      if ![no_deployment_label] and [alert][metadata][deployment][0] != "" {
        mutate {
          replace => {
            "deployment_label.key" => "deployment"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "deployment_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.former_category.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "former_category_label.value" => "%{alert.metadata.former_category.0}"
        }
        on_error => "no_former_category_label"
      }
      if ![no_former_category_label]
      and [alert][metadata][former_category][0] != "" {
        mutate {
          replace => {
            "former_category_label.key" => "former_category"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "former_category_label"
          }
        }
      }

      mutate {
        convert => {
          "alert.metadata.signature_severity.0" => "string"
        }
        on_error => "already_string"
      }
      mutate {
        replace => {
          "signature_severity_label.value" =>
          "%{alert.metadata.signature_severity.0}"
        }
        on_error => "no_signature_severity_label"
      }
      if ![no_signature_severity_label]
      and [alert][metadata][signature_severity][0] != "" {
        mutate {
          replace => {
            "signature_severity_label.key" => "signature_severity"
          }
        }

        mutate {
          merge => {
            "eve_security_result.detection_fields" => "signature_severity_label"
          }
        }
      }

      mutate {
        convert => {
          "flow.bytes_toserver" => "uinteger"
        }
        on_error => "failed_to_convert_toserver"
      }

      mutate {
        rename => {
          "flow.bytes_toserver" => "token_network.sent_bytes"
        }
        on_error => "failed_to_rename"
      }

      mutate {
        convert => {
          "flow.bytes_toclient" => "uinteger"
        }
        on_error => "failed_to_convert_toserver"
      }

      mutate {
        rename => {
          "flow.bytes_toclient" => "token_network.received_bytes"
        }
        on_error => "failed_to_rename"
      }

      # Tuning END ACE

      mutate {
        replace => {
          "is_significant" => "true"
          "is_alert" => "true"
        }
      }
      mutate {
        convert => {
          "is_significant" => "boolean"
          "is_alert" => "boolean"
        }
      }
      mutate {
        rename => {
          "is_significant" => "event.idm.is_significant"
          "is_alert" => "event.idm.is_alert"
        }
      }
    }
    # End alert

    ################################
    # Event_type 'dhcp' specific
    ################################
    #
    if [event_type] == "dhcp" {
      mutate {
        replace => {
          "dhcp_present" => "false"
        }
      }
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DHCP"
        }
      }
      mutate {
        replace => {
          "token_network.application_protocol" => "DHCP"
        }
      }

      mutate {
        replace => {
          "dhcp.dhcp_type" => "%{dhcp.dhcp_type}"
        }
        on_error => "dhcp_type_not_found"
      }
      if ![dhcp_type_not_found] and [dhcp][dhcp_type] != "" {
        mutate {
          uppercase => [ "dhcp.dhcp_type" ]
        }
        mutate {
          replace => {
            "token_network.dhcp.type" => "%{dhcp.dhcp_type}"
          }
        }
      }
      # OpCode proto only supports these two options
      mutate {
        replace => {
          "dhcp.type" => "%{dhcp.type}"
        }
        on_error => "dhcp_type_not_found"
      }
      if ![dhcp_type_not_found] and [dhcp][type] =~ "reply|request" {
        mutate {
          uppercase => [ "dhcp.type" ]
        }
        mutate {
          replace => {
            "token_network.dhcp.opcode" => "BOOT%{dhcp.type}"
          }
        }
        mutate {
          replace => {
            "dhcp_present" => "true"
          }
        }
      }

      mutate {
        rename => {
          "dhcp.assigned_ip" => "assigned_addr"
        }
        on_error => "failed_to_rename"
      }
      grok {
        match => {
          "assigned_addr" => "%{IP:assigned_addr}"
        }
        overwrite => ["assigned_addr"]
        on_error => "assigned_addr_not_found"
      }
      if ![assigned_addr_not_found] {
        mutate {
          replace => {
            "token_network.dhcp.yiaddr" => "%{assigned_addr}"
          }
        }

        mutate {
          replace => {
            "dhcp_present" => "true"
          }
        }
      }


      grok {
        match => {
          "dhcp.client_mac" => "%{MAC:dhcp_client_mac}"
        }
        overwrite => ["dhcp_client_mac"]
        on_error => "dhcp_client_mac_not_matched"
      }
      if ![dhcp_client_mac_not_matched] {
        mutate {
          replace => {
            "token_network.dhcp.chaddr" => "%{dhcp_client_mac}"
          }
        }

        mutate {
          merge => {
            "token_principal.mac" => "dhcp_client_mac"
          }
        }

        mutate {
          replace => {
            "dhcp_present" => "true"
          }
        }

        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
      mutate {
        replace => {
          "token_network.dhcp.client_hostname" => "%{dhcp.hostname}"
        }
        on_error => "hostname_not_found"
      }

      if ![hostname_not_found] {
        mutate {
          replace => {
            "dhcp_present" => "true"
          }
        }
      }
    }
    # End dhcp

    ################################
    # Event_type 'tls' specific
    ################################
    #
    if [event_type] == "tls" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
      mutate {
        replace => {
          "check_tls_ja3s_hash" => "%{tls.ja3s.hash}"
        }
        on_error => "ja3s_check"
      }
      if ![ja3s_check] and [check_tls_ja3s_hash] =~ /^[0-9a-f]+$/ {
        mutate {
          replace => {
            "token_network.tls.server.ja3s" => "%{tls.ja3s.hash}"
          }
          on_error => "hash_not_found"
        }
      }

      mutate {
        replace => {
          "check_tls_ja3_hash" => "%{tls.ja3.hash}"
        }
        on_error => "ja3_check"
      }
      if ![ja3_check] and [check_tls_ja3_hash] =~ /^[0-9a-f]+$/ {
        mutate {
          replace => {
            "token_network.tls.client.ja3" => "%{tls.ja3.hash}"
          }
          on_error => "hash_not_found"
        }
      }

    }
    # End tls

    ################################
    # Event_type 'flow' specific
    ################################

    if [event_type] == "flow" {

      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_FLOW"
        }
      }

      mutate {
        convert => {
          "flow.bytes_toserver" => "uinteger"
        }
        on_error => "failed_to_convert_toserver"
      }

      mutate {
        rename => {
          "flow.bytes_toserver" => "token_network.sent_bytes"
        }
        on_error => "failed_to_rename"
      }

      mutate {
        convert => {
          "flow.bytes_toclient" => "uinteger"
        }
        on_error => "failed_to_convert_toserver"
      }

      mutate {
        rename => {
          "flow.bytes_toclient" => "token_network.received_bytes"
        }
        on_error => "failed_to_rename"
      }

    }
    # End flow

    if [event_type] == "rdp" {

      mutate {
        replace => {
          "metadata.flowbits.0" => "%{metadata.flowbits.0}"
        }
        on_error => "flowbits_not_found"
      }
      if ![flowbits_not_found] {
        if [metadata][flowbits][0] =~ ".*established" {
          mutate {
            replace => {
              "sr_action" => "ALLOW"
            }
          }
        }
        else {
          mutate {
            replace => {
              "sr_action" => "BLOCK"
            }
          }
        }
        mutate {
          merge => {
            "eve_security_result.action" => "sr_action"
          }
        }
      }

      mutate {
        replace => {
          "token_network.community_id" => "%{community_id}"
        }
        on_error => "community_not_found"
      }
    }

    if [event_type] == "snmp" {
      mutate {
        replace => {
          "token_network.community_id" => "%{community_id}"
        }
        on_error => "community_not_found"
      }

      mutate {
        replace => {
          "vars_label.key" => "vars"
        }
      }

      for var in snmp.vars {
        mutate {
          replace => {
            "value_array" => ""
          }
        }
        mutate {
          replace => {
            "value_array.string_value" => "%{var}"
          }
          on_error => "var_not_found"
        }
        if ![var_not_found] and [var] != "" {
          mutate {
            merge => {
              "vars_label.value.list_value.values" => "value_array"
            }
          }
          mutate {
            merge => {
              "token_additional.fields" => "vars_label"
            }
            on_error => "failed_to_merge_var"
          }
        }
      }

      mutate {
        replace => {
          "community_fields.value.string_value" => "%{snmp.community}"
        }
        on_error => "community_not_found"
      }
      if ![community_not_found] and [snmp][community] != "" {
        mutate {
          replace => {
            "community_fields.key" => "community"
          }
        }
        mutate {
          merge => {
            "token_additional.fields" => "community_fields"
          }
        }
      }

      mutate {
        replace => {
          "pdu_type_fields.value.string_value" => "%{snmp.pdu_type}"
        }
        on_error => "pdu_type_not_found"
      }
      if ![pdu_type_not_found] and [snmp][pdu_type] != "" {
        mutate {
          replace => {
            "pdu_type_fields.key" => "pdu_type"
          }
        }
        mutate {
          merge => {
            "token_additional.fields" => "pdu_type_fields"
          }
        }
      }
    }

    mutate {
      replace => {
        "in_iface_label.value" => "%{in_iface}"
      }
      on_error => "in_iface_not_found"
    }

    if ![in_iface_not_found] and [in_iface] != "" {
      mutate {
        replace => {
          "in_iface_label.key" => "in_iface"
        }
      }
      mutate {
        merge => {
          "eve_security_result.rule_labels" => "in_iface_label"
        }
      }
    }

    mutate {
      replace => {
        "token_payload_printable.value" => "%{payload_printable}"
      }
      on_error => "payload_not_found"
    }

    if ![payload_not_found] and [payload_printable] != "" {
      mutate {
        replace => {
          "token_payload_printable.key" => "payload_printable"
        }
      }

      mutate {
        merge => {
          "eve_security_result.detection_fields" => "token_payload_printable"
        }
      }
    }

    mutate {
      replace => {
        "token_rule.value" => "%{alert.rule}"
      }
      on_error => "rule_not_found"
    }

    if ![rule_not_found] and [alert][rule] != "" {
      mutate {
        replace => {
          "token_rule.key" => "rule"
        }
      }

      mutate {
        merge => {
          "eve_security_result.detection_fields" => "token_rule"
        }
      }
    }

    #################################
    # General
    #################################

    date {
      match => ["timestamp", "ISO8601", "RFC3339", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZZZ" ]
      on_error => "failed_parse_date"
    }

    # UDM > Principal
    grok {
      match => {
        "src_ip" => "%{IP:src_ip}"
      }
      overwrite => ["src_ip"]
      on_error => "ip_not_vaild"
    }

    if ![ip_not_vaild] {
      mutate {
        merge => {
          "token_principal.ip" => "src_ip"
        }
      }

      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    mutate {
      convert => {
        "src_port" => "integer"
      }
      on_error => "failed_to_convert_port"
    }
    mutate {
      rename => {
        "src_port" => "token_principal.port"
      }
      on_error => "rename_error"
    }


    # UDM > Target
    grok {
      match => {
        "dest_ip" => "%{IP:dest_ip}"
      }
      overwrite => ["dest_ip"]
      on_error => "ip_not_vaild"
    }

    if ![ip_not_vaild] {
      mutate {
        merge => {
          "token_target.ip" => "dest_ip"
        }
      }

      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      convert => {
        "dest_port" => "integer"
      }
      on_error => "failed_to_convert_port"
    }
    mutate {
      rename => {
        "dest_port" => "token_target.port"
      }
      on_error => "rename_error"
    }
    # UDM > Network

    mutate {
      convert => {
        "flow_id" => "string"
      }
      on_error => "conversion_error"
    }
    mutate {
      replace => {
        "token_network.session_id" => "%{flow_id}"
      }
      on_error => "flow_id_not_found"
    }

    mutate {
      replace => {
        "proto" => "%{proto}"
      }
      on_error => "proto_not_set"
    }

    if ![proto_not_set] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    mutate {
      replace => {
        "app_proto" => "%{app_proto}"
      }
      on_error => "app_proto_not_set"
    }

    if ![app_proto_not_set] {
      mutate {
        uppercase => ["app_proto"]
      }

      if [app_proto] in ["AFP", "AMQP", "APPC", "ATOM", "BEEP", "BIT_TORRENT",
      "BITCOIN", "CFDP", "COAP", "DCERPC", "DDS", "DEVICE_NET", "DHCP",
      "DNS", "E_DONKEY", "ENRP", "FAST_TRACK", "FINGER", "FREENET", "FTAM",
      "GOPHER", "H323", "HL7", "HTTP", "HTTPS", "IRCP", "KADEMLIA", "KRB5",
      "LDAP", "LPD", "MIME", "MODBUS", "MQTT", "NETCONF", "NFS", "NIS",
      "NNTP", "NTCIP", "NTP", "OSCAR", "PNRP", "QUIC", "RDP", "RELP", "RIP",
      "RLOGIN", "RPC", "RTMP", "RTP", "RTPS", "RTSP", "SAP", "SDP", "SIP",
      "SLP", "SMB", "SMTP", "SNTP", "SSH", "SSMS", "STYX", "TCAP", "TDS",
      "TOR", "TSP", "VTP", "WEB_DAV", "WHOIS", "X400", "X500", "XMPP"] {
        mutate {
          replace => {
            "token_network.application_protocol" => "%{app_proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.application_protocol" =>
            "UNKNOWN_APPLICATION_PROTOCOL"
          }
        }
      }
    }

    # UDM > Observer

    mutate {
      replace => {
        "token_observer.hostname" => "%{host}"
      }
      on_error => "host_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "eve_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    mutate {
      merge => {
        "token_intermediary" => "eve_intermediary"
      }
      on_error => "failed_to_merge_intermediary"
    }

    if [token_metadata][event_type] in ["NETWORK_CONNECTION", "NETWORK_HTTP",
    "NETWORK_FLOW"] {
      if [principal_present] == "false" or [target_present] == "false" {
        mutate {
          replace => {
            "token_metadata.event_type" => "STATUS_UPDATE"
          }
        }
      }
    }
    if [token_metadata][event_type] == "NETWORK_DNS" {
      if [principal_present] == "false" or [questions_present] == "false" {
        mutate {
          replace => {
            "token_metadata.event_type" => "STATUS_UPDATE"
          }
        }
      }
    }
    if [token_metadata][event_type] == "NETWORK_DHCP" {
      if [principal_present] == "false" or [dhcp_present] == "false" {
        mutate {
          replace => {
            "token_metadata.event_type" => "STATUS_UPDATE"
          }
        }
      }
    }
    if [token_metadata][event_type] in ["STATUS_UPDATE", "SCAN_NETWORK"] {
      if [principal_present] == "false" {
        mutate {
          replace => {
            "token_metadata.event_type" => "GENERIC_EVENT"
          }
        }
      }
    }
    # Duplicating the ip info into host name to skip the validation while using the udm2sdm flag:
    # *events_go_proto.Event_Edr: client device for EDR network event must have more than IP addresses filled
    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_principal.hostname" => "%{src_ip}"
        }
        on_error => "src_ip_not_found"
      }
    }
  }

  # ----------------------------------------------------------------------
  # ISO COTP
  else if [_path] == "iso_cotp" {

    # UDM > About
    mutate {
      replace => {
        "pdu_type_labels.value" => "%{pdu_type}"
      }
      on_error => "pdu_type_not_found"
    }
    if ![pdu_type_not_found] and [pdu_type] != "" {
      mutate {
        replace => {
          "pdu_type_labels.key" => "pdu_type"
        }
      }
      mutate {
        merge => {
          "iso_cotp_about.labels" => "pdu_type_labels"
        }
      }
    }

    mutate {
      merge => {
        "iso_cotp_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "iso_cotp_about"
      }
      on_error => "iso_cotp_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # KERBEROS
  # - https://docs.zeek.org/en/current/scripts/base/protocols/krb/main.zeek.html
  else if [_path] == "kerberos" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "KRB5"
      }
    }

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.application" => "%{request_type}"
      }
      on_error => "request_type_not_found"
    }

    mutate {
      replace => {
        "token_principal.hostname" => "%{client}"
      }
      on_error => "client_not_found"
    }
    if ![client_not_found] {
      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.application" => "%{service}"
      }
      on_error => "service_not_found"
    }

    # UDM > About
    mutate {
      replace => {
        "from_labels.value" => "%{from}"
      }
      on_error => "from_not_found"
    }
    if ![from_not_found] and [from] != "" {
      mutate {
        replace => {
          "from_labels.key" => "from"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "from_labels"
        }
      }
    }

    mutate {
      replace => {
        "till_labels.value" => "%{till}"
      }
      on_error => "till_not_found"
    }
    if ![till_not_found] and [till] != "" {
      mutate {
        replace => {
          "till_labels.key" => "till"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "till_labels"
        }
      }
    }

    mutate {
      replace => {
        "cipher_labels.value" => "%{cipher}"
      }
      on_error => "cipher_not_found"
    }
    if ![cipher_not_found] and [cipher] != "" {
      mutate {
        replace => {
          "cipher_labels.key" => "cipher"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "cipher_labels"
        }
      }
    }

    mutate {
      convert => {
        "forwardable" => "string"
      }
      on_error => "forwardable_conversion_error"
    }

    mutate {
      replace => {
        "forwardable_labels.value" => "%{forwardable}"
      }
      on_error => "forwardable_not_found"
    }
    if ![forwardable_not_found] and [forwardable] != "" {
      mutate {
        replace => {
          "forwardable_labels.key" => "forwardable"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "forwardable_labels"
        }
      }
    }

    mutate {
      convert => {
        "renewable" => "string"
      }
      on_error => "renewable_conversion_error"
    }

    mutate {
      replace => {
        "renewable_labels.value" => "%{renewable}"
      }
      on_error => "renewable_not_found"
    }
    if ![renewable_not_found] and [renewable] != "" {
      mutate {
        replace => {
          "renewable_labels.key" => "renewable"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "renewable_labels"
        }
      }
    }

    mutate {
      replace => {
        "client_cert_subject_labels.value" => "%{client_cert_subject}"
      }
      on_error => "client_cert_subject_not_found"
    }
    if ![client_cert_subject_not_found] and [client_cert_subject] != "" {
      mutate {
        replace => {
          "client_cert_subject_labels.key" => "client_cert_subject"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "client_cert_subject_labels"
        }
      }
    }

    mutate {
      replace => {
        "client_cert_fuid_labels.value" => "%{client_cert_fuid}"
      }
      on_error => "client_cert_fuid_not_found"
    }
    if ![client_cert_fuid_not_found] and [client_cert_fuid] != "" {
      mutate {
        replace => {
          "client_cert_fuid_labels.key" => "client_cert_fuid"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "client_cert_fuid_labels"
        }
      }
    }

    mutate {
      replace => {
        "server_cert_subject_labels.value" => "%{server_cert_subject}"
      }
      on_error => "server_cert_subject_not_found"
    }
    if ![server_cert_subject_not_found] and [server_cert_subject] != "" {
      mutate {
        replace => {
          "server_cert_subject_labels.key" => "server_cert_subject"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "server_cert_subject_labels"
        }
      }
    }

    mutate {
      replace => {
        "server_cert_fuid_labels.value" => "%{server_cert_fuid}"
      }
      on_error => "server_cert_fuid_not_found"
    }
    if ![server_cert_fuid_not_found] and [server_cert_fuid] != "" {
      mutate {
        replace => {
          "server_cert_fuid_labels.key" => "server_cert_fuid"
        }
      }
      mutate {
        merge => {
          "kerberos_about.labels" => "server_cert_fuid_labels"
        }
      }
    }

    mutate {
      merge => {
        "kerberos_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "kerberos_about"
      }
      on_error => "kerberos_about_not_found"
    }

    # UDM > Security Result
    mutate {
      convert => {
        "success" => "string"
      }
      on_error => "success_conversion_failed"
    }
    mutate {
      replace => {
        "var_success" => "%{success}"
      }
      on_error => "success_not_found"
    }
    if ![success_not_found] {
      if [success] == "true" {
        mutate {
          replace => {
            "sr_action" => "ALLOW"
          }
        }
      }
      else {
        mutate {
          replace => {
            "sr_action" => "FAIL"
          }
        }
      }
      mutate {
        merge => {
          "kerberos_security_result.action" => "sr_action"
        }
        on_error => "sr_action_not_found"
      }
    }

    mutate {
      replace => {
        "kerberos_security_result.action_details" => "%{error_msg}"
      }
      on_error => "error_msg_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "kerberos_security_result"
      }
      on_error => "kerberos_security_result_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # LDAP
  else if [_path] == "ldap" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "LDAP"
      }
    }

    mutate {
      convert => {
        "version" => "string"
      }
      on_error => "version_conversion_failed"
    }
    mutate {
      replace => {
        "token_network.application_protocol_version" => "%{version}"
      }
      on_error => "version_not_found"
    }

    # UDM > About
    mutate {
      replace => {
        "proto_labels.value" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] and [proto] != "" {
      mutate {
        replace => {
          "proto_labels.key" => "proto"
        }
      }
      mutate {
        merge => {
          "ldap_about.labels" => "proto_labels"
        }
      }
    }

    mutate {
      convert => {
        "message_id" => "string"
      }
      on_error => "message_id_conversion_error"
    }
    mutate {
      replace => {
        "message_id_labels.value" => "%{message_id}"
      }
      on_error => "message_id_not_found"
    }
    if ![message_id_not_found] and [message_id] != "" {
      mutate {
        replace => {
          "message_id_labels.key" => "message_id"
        }
      }
      mutate {
        merge => {
          "ldap_about.labels" => "message_id_labels"
        }
      }
    }

    for obj in object {
      mutate {
        replace => {
          "object_labels" => ""
        }
      }
      mutate {
        replace => {
          "object_labels.value" => "%{obj}"
        }
        on_error => "object_not_found"
      }
      if ![object_not_found] and [obj] != "" {
        mutate {
          replace => {
            "object_labels.key" => "object"
          }
        }
        mutate {
          merge => {
            "ldap_about.labels" => "object_labels"
          }
        }
      }
    }

    for arg in argument {
      mutate {
        replace => {
          "argument_labels" => ""
        }
      }
      mutate {
        replace => {
          "argument_labels.value" => "%{arg}"
        }
        on_error => "argument_not_found"
      }
      if ![argument_not_found] and [arg] != "" {
        mutate {
          replace => {
            "argument_labels.key" => "argument"
          }
        }
        mutate {
          merge => {
            "ldap_about.labels" => "argument_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "ldap_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "ldap_about"
      }
      on_error => "ldap_about_not_found"
    }

    # UDM > Security Result
    for index_opcode,var_opcode in opcode {
      for index_result,var_result in result {
        for index_diagnostic_message,var_diagnostic_message
        in diagnostic_message {
          if [index_opcode] == [index_result] and
          [index_result] == [index_diagnostic_message] {
            mutate {
              replace => {
                "var_security_result" => ""
                "var_opcode_labels" => ""
                "var_result_labels" => ""
              }
            }

            mutate {
              replace => {
                "var_opcode_labels.value" => "%{var_opcode}"
              }
              on_error => "var_opcode_not_found"
            }
            if ![var_opcode_not_found] and [var_opcode] != "" {
              mutate {
                replace => {
                  "var_opcode_labels.key" => "opcode"
                }
              }
              mutate {
                merge => {
                  "var_security_result.detection_fields" => "var_opcode_labels"
                }
              }
            }

            mutate {
              replace => {
                "var_result_labels.value" => "%{var_result}"
              }
              on_error => "var_result_not_found"
            }
            if ![var_result_not_found] and [var_result] != "" {
              mutate {
                replace => {
                  "var_result_labels.key" => "result"
                }
              }
              mutate {
                merge => {
                  "var_security_result.detection_fields" => "var_result_labels"
                }
              }
            }

            mutate {
              replace => {
                "var_security_result.description" => "%{var_diagnostic_message}"
              }
              on_error => "var_diagnostic_message_not_found"
            }

            mutate {
              merge => {
                "token_security_result" => "var_security_result"
              }
              on_error => "var_security_result_not_found"
            }
          }
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # LDAP SEARCH
  else if [_path] == "ldap_search" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "LDAP"
      }
    }

    # UDM > About
    mutate {
      replace => {
        "proto_labels.value" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] and [proto] != "" {
      mutate {
        replace => {
          "proto_labels.key" => "proto"
        }
      }
      mutate {
        merge => {
          "ldap_search_about.labels" => "proto_labels"
        }
      }
    }

    mutate {
      convert => {
        "message_id" => "string"
      }
      on_error => "message_id_conversion_error"
    }
    mutate {
      replace => {
        "message_id_labels.value" => "%{message_id}"
      }
      on_error => "message_id_not_found"
    }
    if ![message_id_not_found] and [message_id] != "" {
      mutate {
        replace => {
          "message_id_labels.key" => "message_id"
        }
      }
      mutate {
        merge => {
          "ldap_search_about.labels" => "message_id_labels"
        }
      }
    }

    mutate {
      replace => {
        "filter_labels.value" => "%{filter}"
      }
      on_error => "filter_not_found"
    }
    if ![filter_not_found] and [filter] != "" {
      mutate {
        replace => {
          "filter_labels.key" => "filter"
        }
      }
      mutate {
        merge => {
          "ldap_search_about.labels" => "filter_labels"
        }
      }
    }

    for i,var_scope in scope {
      mutate {
        replace => {
          "var_scope_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_scope_labels.value" => "%{var_scope}"
        }
        on_error => "var_scope_not_found"
      }
      if ![var_scope_not_found] and [var_scope] != "" {
        mutate {
          replace => {
            "var_scope_labels.key" => "scope"
          }
        }
        mutate {
          merge => {
            "ldap_search_about.labels" => "var_scope_labels"
          }
        }
      }
    }

    for i,var_deref in deref {
      mutate {
        replace => {
          "var_deref_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_deref_labels.value" => "%{var_deref}"
        }
        on_error => "var_deref_not_found"
      }
      if ![var_deref_not_found] and [var_deref] != "" {
        mutate {
          replace => {
            "var_deref_labels.key" => "deref"
          }
        }
        mutate {
          merge => {
            "ldap_search_about.labels" => "var_deref_labels"
          }
        }
      }
    }

    for i,var_base_object in base_object {
      mutate {
        replace => {
          "var_base_object_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_base_object_labels.value" => "%{var_base_object}"
        }
        on_error => "var_base_object_not_found"
      }
      if ![var_base_object_not_found] and [var_base_object] != "" {
        mutate {
          replace => {
            "var_base_object_labels.key" => "base_object"
          }
        }
        mutate {
          merge => {
            "ldap_search_about.labels" => "var_base_object_labels"
          }
        }
      }
    }

    for i,var_attributes in attributes {
      mutate {
        replace => {
          "var_attributes_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_attributes_labels.value" => "%{var_attributes}"
        }
        on_error => "var_attributes_not_found"
      }
      if ![var_attributes_not_found] and [var_attributes] != "" {
        mutate {
          replace => {
            "var_attributes_labels.key" => "attributes"
          }
        }
        mutate {
          merge => {
            "ldap_search_about.labels" => "var_attributes_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "ldap_search_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "ldap_search_about"
      }
      on_error => "ldap_search_about_not_found"
    }

    # UDM > Security Result
    mutate {
      convert => {
        "result_count" => "string"
      }
      on_error => "result_count_conversion_error"
    }

    mutate {
      replace => {
        "result_count_labels.value" => "%{result_count}"
      }
      on_error => "result_count_not_found"
    }
    if ![result_count_not_found] and [result_count] != "" {
      mutate {
        replace => {
          "result_count_labels.key" => "result_count"
        }
      }
      mutate {
        merge => {
          "ldap_search_security_result.detection_fields" =>
          "result_count_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "ldap_search_security_result"
      }
      on_error => "ldap_search_security_result"
    }

    for index_result,var_result in result {
      for index_diagnostic_message,var_diagnostic_message
      in diagnostic_message {
        if [index_result] == [index_diagnostic_message] {
          mutate {
            replace => {
              "var_security_result" => ""
              "var_result_labels" => ""
            }
          }

          mutate {
            replace => {
              "var_result_labels.value" => "%{var_result}"
            }
            on_error => "var_result_not_found"
          }
          if ![var_result_not_found] and [var_result] != "" {
            mutate {
              replace => {
                "var_result_labels.key" => "result"
              }
            }
            mutate {
              merge => {
                "var_security_result.detection_fields" => "var_result_labels"
              }
            }
          }

          mutate {
            replace => {
              "var_security_result.description" => "%{var_diagnostic_message}"
            }
            on_error => "var_diagnostic_message_not_found"
          }

          mutate {
            merge => {
              "token_security_result" => "var_security_result"
            }
            on_error => "var_security_result_not_found"
          }
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # LOCAL SUBNETS
  else if [_path] == "local_subnets" {

    # UDM > About
    mutate {
      convert => {
        "round" => "string"
      }
      on_error => "round_conversion_error"
    }

    mutate {
      replace => {
        "round_labels.value" => "%{round}"
      }
      on_error => "round_not_found"
    }
    if ![round_not_found] and [round] != "" {
      mutate {
        replace => {
          "round_labels.key" => "round"
        }
      }
      mutate {
        merge => {
          "local_subnets_about.labels" => "round_labels"
        }
      }
    }

    mutate {
      convert => {
        "ip_version" => "string"
      }
      on_error => "ip_version_conversion_error"
    }

    mutate {
      replace => {
        "ip_version_labels.value" => "%{ip_version}"
      }
      on_error => "ip_version_not_found"
    }
    if ![ip_version_not_found] and [ip_version] != "" {
      mutate {
        replace => {
          "ip_version_labels.key" => "ip_version"
        }
      }
      mutate {
        merge => {
          "local_subnets_about.labels" => "ip_version_labels"
        }
      }
    }

    for subnet in subnets {
      mutate {
        replace => {
          "subnets_labels" => ""
        }
      }
      mutate {
        replace => {
          "subnets_labels.value" => "%{subnet}"
        }
        on_error => "subnets_not_found"
      }
      if ![subnets_not_found] and [subnet] != "" {
        mutate {
          replace => {
            "subnets_labels.key" => "subnet"
          }
        }
        mutate {
          merge => {
            "local_subnets_about.labels" => "subnets_labels"
          }
        }
      }
    }

    for compid in component_ids {
      mutate {
        replace => {
          "component_ids_labels" => ""
        }
      }
      mutate {
        convert => {
          "compid" => "string"
        }
        on_error => "component_ids_conversion_error"
      }

      mutate {
        replace => {
          "component_ids_labels.value" => "%{compid}"
        }
        on_error => "component_ids_not_found"
      }
      if ![component_ids_not_found] and [compid] != "" {
        mutate {
          replace => {
            "component_ids_labels.key" => "component_id"
          }
        }
        mutate {
          merge => {
            "local_subnets_about.labels" => "component_ids_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "size_of_component" => "string"
      }
      on_error => "size_of_component_conversion_error"
    }

    mutate {
      replace => {
        "size_of_component_labels.value" => "%{size_of_component}"
      }
      on_error => "size_of_component_not_found"
    }
    if ![size_of_component_not_found] and [size_of_component] != "" {
      mutate {
        replace => {
          "size_of_component_labels.key" => "size_of_component"
        }
      }
      mutate {
        merge => {
          "local_subnets_about.labels" => "size_of_component_labels"
        }
      }
    }

    mutate {
      convert => {
        "bipartite" => "string"
      }
      on_error => "bipartite_conversion_error"
    }

    mutate {
      replace => {
        "bipartite_labels.value" => "%{bipartite}"
      }
      on_error => "bipartite_not_found"
    }
    if ![bipartite_not_found] and [bipartite] != "" {
      mutate {
        replace => {
          "bipartite_labels.key" => "bipartite"
        }
      }
      mutate {
        merge => {
          "local_subnets_about.labels" => "bipartite_labels"
        }
      }
    }

    mutate {
      convert => {
        "inferred_site" => "string"
      }
      on_error => "inferred_site_conversion_error"
    }

    mutate {
      replace => {
        "inferred_site_labels.value" => "%{inferred_site}"
      }
      on_error => "inferred_site_not_found"
    }
    if ![inferred_site_not_found] and [inferred_site] != "" {
      mutate {
        replace => {
          "inferred_site_labels.key" => "inferred_site"
        }
      }
      mutate {
        merge => {
          "local_subnets_about.labels" => "inferred_site_labels"
        }
      }
    }

    for i,var_other_ips in other_ips {
      grok {
        match => {
          "var_other_ips" => "%{IP:var_other_ips}"
        }
        overwrite => ["var_other_ips"]
        on_error => "var_other_ips_not_ip"
      }
      if ![var_other_ips_not_ip] {
        mutate {
          merge => {
            "local_subnets_about.ip" => "var_other_ips"
          }
        }
      }
    }

    mutate {
      merge => {
        "local_subnets_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "local_subnets_about"
      }
      on_error => "local_subnets_about_not_found"
    }
  }

  # ----------------------------------------------------------------------
  # LOCAL SUBNETS DJ
  else if [_path] == "local_subnets_dj" {

    # UDM > About
    mutate {
      convert => {
        "ip_version" => "string"
      }
      on_error => "ip_version_conversion_error"
    }

    mutate {
      replace => {
        "ip_version_labels.value" => "%{ip_version}"
      }
      on_error => "ip_version_not_found"
    }
    if ![ip_version_not_found] and [ip_version] != "" {
      mutate {
        replace => {
          "ip_version_labels.key" => "ip_version"
        }
      }
      mutate {
        merge => {
          "local_subnets_dj_about.labels" => "ip_version_labels"
        }
      }
    }

    grok {
      match => {
        "v" => "%{IP:v}"
      }
      overwrite => ["v"]
      on_error => "v_not_ip"
    }
    if ![v_not_ip] {
      mutate {
        merge => {
          "local_subnets_dj_about.ip" => "v"
        }
        on_error => "v_not_found"
      }
    }

    mutate {
      replace => {
        "side_labels.value" => "%{side}"
      }
      on_error => "side_not_found"
    }
    if ![side_not_found] and [side] != "" {
      mutate {
        replace => {
          "side_labels.key" => "side"
        }
      }
      mutate {
        merge => {
          "local_subnets_dj_about.labels" => "side_labels"
        }
      }
    }

    mutate {
      merge => {
        "local_subnets_dj_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "local_subnets_dj_about"
      }
      on_error => "local_subnets_dj_about_not_found"
    }

    # UDM > additional
    mutate {
      convert => {
        "component_id" => "string"
      }
      on_error => "component_id_conversion_error"
    }

    mutate {
      replace => {
        "component_id_label.value.string_value" => "%{component_id}"
      }
      on_error => "component_id_not_found"
    }

    if ![component_id_not_found] and
      [component_id_label][value][string_value] != "" {
      mutate {
        replace => {
          "component_id_label.key" => "component_id"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "component_id_label"
        }
      }
    }

    mutate {
      convert => {
        "round" => "string"
      }
      on_error => "round_conversion_error"
    }

    mutate {
      replace => {
        "round_label.value.string_value" => "%{round}"
      }
      on_error => "round_not_found"
    }

    if ![round_not_found] and [round_label][value][string_value] != "" {
      mutate {
        replace => {
          "round_label.key" => "round"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "round_label"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # LOCAL SUBNETS GRAPHS
  else if [_path] == "local_subnets_graphs" {

    # UDM > About
    mutate {
      convert => {
        "ip_version" => "string"
      }
      on_error => "ip_version_conversion_error"
    }

    mutate {
      replace => {
        "ip_version_labels.value" => "%{ip_version}"
      }
      on_error => "ip_version_not_found"
    }
    if ![ip_version_not_found] and [ip_version] != "" {
      mutate {
        replace => {
          "ip_version_labels.key" => "ip_version"
        }
      }
      mutate {
        merge => {
          "local_subnets_graphs_about.labels" => "ip_version_labels"
        }
      }
    }

    grok {
      match => {
        "v1" => "%{IP:v1}"
      }
      overwrite => ["v1"]
      on_error => "v1_not_ip"
    }
    if ![v1_not_ip] {
      mutate {
        merge => {
          "local_subnets_graphs_about.ip" => "v1"
        }
        on_error => "v1_not_found"
      }
    }

    grok {
      match => {
        "v2" => "%{IP:v2}"
      }
      overwrite => ["v2"]
      on_error => "v2_not_ip"
    }
    if ![v2_not_ip] {
      mutate {
        merge => {
          "local_subnets_graphs_about.ip" => "v2"
        }
        on_error => "v2_not_found"
      }
    }

    mutate {
      merge => {
        "local_subnets_graphs_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "local_subnets_graphs_about"
      }
      on_error => "local_subnets_graphs_about_not_found"
    }
  }

  # ----------------------------------------------------------------------
  # LOG4SHELL
  else if [_path] == "log4shell" {

    # UDM > Extensions
    mutate {
      replace => {
        "var_vulnerabilities.cve_id" => "CVE-2021-44228"
      }
    }
    mutate {
      merge => {
        "token_extensions.vulns.vulnerabilities" => "var_vulnerabilities"
      }
      on_error => "var_vulnerabilities_not_found"
    }

    # UDM > Network
    mutate {
      replace => {
        "token_network.http.method" => "%{method}"
      }
      on_error => "method_not_found"
    }

    # UDM > Target
    mutate {
      replace => {
        "token_target.url" => "%{uri}"
      }
      on_error => "uri_not_found"
    }

    mutate {
      replace => {
        "token_target.hostname" => "%{target_host}"
      }
      on_error => "target_host_not_found"
    }

    mutate {
      replace => {
        "var_target_port" => "%{target_port}"
      }
      on_error => "target_port_not_found"
    }
    if ![target_port_not_found] {
      mutate {
        convert => {
          "target_port" => "integer"
        }
        on_error => "target_port_conversion_failure"
      }
      if ![target_port_conversion_failure] and [target_port] != "" {
        mutate {
          rename => {
            "target_port" => "token_target.port"
          }
        }
      }
    }

    mutate {
      replace => {
        "stem_labels.value" => "%{stem}"
      }
      on_error => "stem_not_found"
    }
    if ![stem_not_found] and [stem] != "" {
      mutate {
        replace => {
          "stem_labels.key" => "stem"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "stem_labels"
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "http_uri_labels.value" => "%{http_uri}"
      }
      on_error => "http_uri_not_found"
    }
    if ![http_uri_not_found] and [http_uri] != "" {
      mutate {
        replace => {
          "http_uri_labels.key" => "http_uri"
        }
      }
      mutate {
        merge => {
          "log4shell_about.labels" => "http_uri_labels"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_labels.value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }
    if ![is_orig_not_found] and [is_orig] != "" {
      mutate {
        replace => {
          "is_orig_labels.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "log4shell_about.labels" => "is_orig_labels"
        }
      }
    }

    mutate {
      convert => {
        "matched_name" => "string"
      }
      on_error => "matched_name_conversion_error"
    }

    mutate {
      replace => {
        "matched_name_labels.value" => "%{matched_name}"
      }
      on_error => "matched_name_not_found"
    }
    if ![matched_name_not_found] and [matched_name] != "" {
      mutate {
        replace => {
          "matched_name_labels.key" => "matched_name"
        }
      }
      mutate {
        merge => {
          "log4shell_about.labels" => "matched_name_labels"
        }
      }
    }

    mutate {
      convert => {
        "matched_value" => "string"
      }
      on_error => "matched_value_conversion_error"
    }

    mutate {
      replace => {
        "matched_value_labels.value" => "%{matched_value}"
      }
      on_error => "matched_value_not_found"
    }
    if ![matched_value_not_found] and [matched_value] != "" {
      mutate {
        replace => {
          "matched_value_labels.key" => "matched_value"
        }
      }
      mutate {
        merge => {
          "log4shell_about.labels" => "matched_value_labels"
        }
      }
    }

    mutate {
      replace => {
        "name_value_labels.value" => "%{value}"
      }
      on_error => "value_not_found"
    }
    if ![value_not_found] and [value] != "" {
      mutate {
        replace => {
          "name_value_labels.key" => "%{name}"
        }
        on_error => "name_not_found"
      }
      if ![name_not_found] and [name] != "" {
        mutate {
          merge => {
            "log4shell_about.labels" => "name_value_labels"
          }
          on_error => "name_value_labels_not_found"
        }
      }
    }

    mutate {
      merge => {
        "log4shell_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "log4shell_about"
      }
      on_error => "log4shell_about_not_found"
    }

    # Duplicating the _system_name info into host name to skip the validation for SCAN_HOST
    mutate {
      replace => {
        "token_principal.hostname" => "%{_system_name}"
      }
      on_error => "principal_hostname_not_set"
    }
  }

  # ----------------------------------------------------------------------
  # MODBUS
  # - https://docs.zeek.org/en/current/scripts/base/protocols/modbus/main.zeek.html
  else if [_path] == "modbus" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "MODBUS"
      }
    }

    # UDM > About
    mutate {
      replace => {
        "func_labels.value" => "%{func}"
      }
      on_error => "func_not_found"
    }
    if ![func_not_found] and [func] != "" {
      mutate {
        replace => {
          "func_labels.key" => "func"
        }
      }
      mutate {
        merge => {
          "modbus_about.labels" => "func_labels"
        }
      }
    }

    mutate {
      merge => {
        "modbus_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "modbus_about"
      }
      on_error => "modbus_about_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "modbus_security_result.description" => "%{exception}"
      }
      on_error => "exception_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "modbus_security_result"
      }
      on_error => "modbus_security_result_not_found"
    }

    # UDM > additional
    mutate {
      convert => {
        "pdu_type" => "string"
      }
      on_error => "pdu_type_conversion_error"
    }

    mutate {
      replace => {
        "pdu_type_label.value.string_value" => "%{pdu_type}"
      }
      on_error => "pdu_type_not_found"
    }

    if ![pdu_type_not_found] and
      [pdu_type_label][value][string_value] != "" {
      mutate {
        replace => {
          "pdu_type_label.key" => "pdu_type"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "pdu_type_label"
        }
      }
    }

    mutate {
      convert => {
        "tid" => "string"
      }
      on_error => "tid_conversion_error"
    }

    mutate {
      replace => {
        "tid_label.value.string_value" => "%{tid}"
      }
      on_error => "tid_not_found"
    }

    if ![tid_not_found] and [tid_label][value][string_value] != "" {
      mutate {
        replace => {
          "tid_label.key" => "tid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "tid_label"
        }
      }
    }

    mutate {
      convert => {
        "unit" => "string"
      }
      on_error => "unit_conversion_error"
    }

    mutate {
      replace => {
        "unit_label.value.string_value" => "%{unit}"
      }
      on_error => "unit_not_found"
    }

    if ![unit_not_found] and [unit_label][value][string_value] != "" {
      mutate {
        replace => {
          "unit_label.key" => "unit"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "unit_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # MQTT CONNECT
  # - https://docs.zeek.org/en/current/scripts/base/protocols/mqtt/main.zeek.html
  else if [_path] == "mqtt_connect" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "MQTT"
      }
    }

    mutate {
      replace => {
        "token_network.application_protocol_version" => "%{proto_version}"
      }
      on_error => "proto_version_not_found"
    }

    # UDM > Principal
    mutate {
      replace => {
        "client_id_labels.value" => "%{client_id}"
      }
      on_error => "client_id_not_found"
    }
    if ![client_id_not_found] and [client_id] != "" {
      mutate {
        replace => {
          "client_id_labels.key" => "client_id"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "client_id_labels"
        }
      }
    }

    # UDM > About
    mutate {
      replace => {
        "proto_name_labels.value" => "%{proto_name}"
      }
      on_error => "proto_name_not_found"
    }
    if ![proto_name_not_found] and [proto_name] != "" {
      mutate {
        replace => {
          "proto_name_labels.key" => "proto_name"
        }
      }
      mutate {
        merge => {
          "mqtt_connect_about.labels" => "proto_name_labels"
        }
      }
    }

    mutate {
      replace => {
        "will_topic_labels.value" => "%{will_topic}"
      }
      on_error => "will_topic_not_found"
    }
    if ![will_topic_not_found] and [will_topic] != "" {
      mutate {
        replace => {
          "will_topic_labels.key" => "will_topic"
        }
      }
      mutate {
        merge => {
          "mqtt_connect_about.labels" => "will_topic_labels"
        }
      }
    }

    mutate {
      replace => {
        "will_payload_labels.value" => "%{will_payload}"
      }
      on_error => "will_payload_not_found"
    }
    if ![will_payload_not_found] and [will_payload] != "" {
      mutate {
        replace => {
          "will_payload_labels.key" => "will_payload"
        }
      }
      mutate {
        merge => {
          "mqtt_connect_about.labels" => "will_payload_labels"
        }
      }
    }

    mutate {
      merge => {
        "mqtt_connect_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "mqtt_connect_about"
      }
      on_error => "mqtt_connect_about_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "mqtt_connect_security_result.description" => "%{connect_status}"
      }
      on_error => "connect_status_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "mqtt_connect_security_result"
      }
      on_error => "mqtt_connect_security_result_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # MQTT PUBLISH
  # - https://docs.zeek.org/en/current/scripts/base/protocols/mqtt/main.zeek.html
  else if [_path] == "mqtt_publish" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "MQTT"
      }
    }

    # UDM > Target
    mutate {
      convert => {
        "retain" => "string"
      }
      on_error => "retain_conversion_error"
    }

    mutate {
      replace => {
        "retain_labels.value" => "%{retain}"
      }
      on_error => "retain_not_found"
    }
    if ![retain_not_found] and [retain] != "" {
      mutate {
        replace => {
          "retain_labels.key" => "retain"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "retain_labels"
        }
      }
    }

    # UDM > About
    mutate {
      convert => {
        "from_client" => "string"
      }
      on_error => "from_client_conversion_error"
    }
    mutate {
      replace => {
        "from_client_labels.value" => "%{from_client}"
      }
      on_error => "from_client_not_found"
    }
    if ![from_client_not_found] and [from_client] != "" {
      mutate {
        replace => {
          "from_client_labels.key" => "from_client"
        }
      }
      mutate {
        merge => {
          "mqtt_publish_about.labels" => "from_client_labels"
        }
      }
    }

    mutate {
      replace => {
        "qos_labels.value" => "%{qos}"
      }
      on_error => "qos_not_found"
    }
    if ![qos_not_found] and [qos] != "" {
      mutate {
        replace => {
          "qos_labels.key" => "qos"
        }
      }
      mutate {
        merge => {
          "mqtt_publish_about.labels" => "qos_labels"
        }
      }
    }

    mutate {
      replace => {
        "topic_labels.value" => "%{topic}"
      }
      on_error => "topic_not_found"
    }
    if ![topic_not_found] and [topic] != "" {
      mutate {
        replace => {
          "topic_labels.key" => "topic"
        }
      }
      mutate {
        merge => {
          "mqtt_publish_about.labels" => "topic_labels"
        }
      }
    }

    mutate {
      replace => {
        "payload_labels.value" => "%{payload}"
      }
      on_error => "payload_not_found"
    }
    if ![payload_not_found] and [payload] != "" {
      mutate {
        replace => {
          "payload_labels.key" => "payload"
        }
      }
      mutate {
        merge => {
          "mqtt_publish_about.labels" => "payload_labels"
        }
      }
    }

    mutate {
      convert => {
        "payload_len" => "string"
      }
      on_error => "payload_len_conversion_error"
    }
    mutate {
      replace => {
        "payload_len_labels.value" => "%{payload_len}"
      }
      on_error => "payload_len_not_found"
    }
    if ![payload_len_not_found] and [payload_len] != "" {
      mutate {
        replace => {
          "payload_len_labels.key" => "payload_len"
        }
      }
      mutate {
        merge => {
          "mqtt_publish_about.labels" => "payload_len_labels"
        }
      }
    }

    mutate {
      merge => {
        "mqtt_publish_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "mqtt_publish_about"
      }
      on_error => "mqtt_publish_about_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "mqtt_publish_security_result.description" => "%{status}"
      }
      on_error => "status_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "mqtt_publish_security_result"
      }
      on_error => "mqtt_publish_security_result_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # MQTT SUBSCRIBE
  # - https://docs.zeek.org/en/current/scripts/base/protocols/mqtt/main.zeek.html
  else if [_path] == "mqtt_subscribe" {

    # UDM > Network
    mutate {
      replace => {
        "token_network.application_protocol" => "MQTT"
      }
    }

    # UDM > About
    mutate {
      convert => {
        "granted_qos_level" => "string"
      }
      on_error => "granted_qos_level_conversion_error"
    }

    mutate {
      replace => {
        "granted_qos_level_labels.value" => "%{granted_qos_level}"
      }
      on_error => "granted_qos_level_not_found"
    }
    if ![granted_qos_level_not_found] and [granted_qos_level] != "" {
      mutate {
        replace => {
          "granted_qos_level_labels.key" => "granted_qos_level"
        }
      }
      mutate {
        merge => {
          "mqtt_subscribe_about.labels" => "granted_qos_level_labels"
        }
      }
    }

    for i,var_topics in topics {
      mutate {
        replace => {
          "var_topics_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_topics_labels.value" => "%{var_topics}"
        }
        on_error => "var_topics_not_found"
      }
      if ![var_topics_not_found] and [var_topics] != "" {
        mutate {
          replace => {
            "var_topics_labels.key" => "topics"
          }
        }
        mutate {
          merge => {
            "mqtt_subscribe_about.labels" => "var_topics_labels"
          }
        }
      }
    }

    for i,var_qos_levels in qos_levels {
      mutate {
        replace => {
          "var_qos_levels_labels" => ""
        }
      }
      mutate {
        convert => {
          "var_qos_levels" => "string"
        }
        on_error => "var_qos_levels_conversion_error"
      }

      mutate {
        replace => {
          "var_qos_levels_labels.value" => "%{var_qos_levels}"
        }
        on_error => "var_qos_levels_not_found"
      }
      if ![var_qos_levels_not_found] and [var_qos_levels] != "" {
        mutate {
          replace => {
            "var_qos_levels_labels.key" => "qos_levels"
          }
        }
        mutate {
          merge => {
            "mqtt_subscribe_about.labels" => "var_qos_levels_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "mqtt_subscribe_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "mqtt_subscribe_about"
      }
      on_error => "mqtt_subscribe_about_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "mqtt_subscribe_security_result.action_details" => "%{action}"
      }
      on_error => "action_not_found"
    }

    mutate {
      convert => {
        "ack" => "string"
      }
      on_error => "ack_conversion_error"
    }
    mutate {
      replace => {
        "ack_labels.value" => "%{ack}"
      }
      on_error => "ack_not_found"
    }
    if ![ack_not_found] and [ack] != "" {
      mutate {
        replace => {
          "ack_labels.key" => "ack"
        }
      }
      mutate {
        merge => {
          "mqtt_subscribe_security_result.detection_fields" => "ack_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "mqtt_subscribe_security_result"
      }
      on_error => "mqtt_subscribe_security_result_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN CERTS
  else if [_path] == "known_certs" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
      }
    }

    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "RESOURCE"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_certs_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_certs_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_certs_security_result.detection_fields" => "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_certs_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    mutate {
      replace => {
        "token_entity.resource.resource_subtype" => "CERTIFICATE"
      }
    }

    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
    }

    mutate {
      convert => {
        "port" => "integer"
      }
      on_error => "port_num_conversion_failed"
    }

    mutate {
      rename => {
        "port" => "token_entity.port"
      }
    }

    mutate {
      convert => {
        "port_num" => "integer"
      }
      on_error => "port_num_conversion_failed"
    }

    mutate {
      rename => {
        "port_num" => "token_entity.port"
      }
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    mutate {
      replace => {
        "protocol_labels.value" => "%{protocol}"
      }
      on_error => "protocol_not_found"
    }
    if ![protocol_not_found] and [protocol] != "" {
      mutate {
        replace => {
          "protocol_labels.key" => "protocol"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "protocol_labels"
        }
      }
    }

    mutate {
      replace => {
        "hash_labels.value" => "%{hash}"
      }
      on_error => "hash_not_found"
    }
    if ![hash_not_found] and [hash] != "" {
      mutate {
        replace => {
          "hash_labels.key" => "hash"
        }
      }
      mutate {
        merge => {
          "token_entity.resource.attribute.labels" => "hash_labels"
        }
      }
    }

    mutate {
      replace => {
        "issuer_subject_labels.value" => "%{issuer_subject}"
      }
      on_error => "issuer_subject_not_found"
    }
    if ![issuer_subject_not_found] and [issuer_subject] != "" {
      mutate {
        replace => {
          "issuer_subject_labels.key" => "issuer_subject"
        }
      }
      mutate {
        merge => {
          "token_entity.resource.attribute.labels" => "issuer_subject_labels"
        }
      }
    }

    mutate {
      replace => {
        "serial_labels.value" => "%{serial}"
      }
      on_error => "serial_not_found"
    }
    if ![serial_not_found] and [serial] != "" {
      mutate {
        replace => {
          "serial_labels.key" => "serial"
        }
      }
      mutate {
        merge => {
          "token_entity.resource.attribute.labels" => "serial_labels"
        }
      }
    }

    mutate {
      replace => {
        "subject_labels.value" => "%{subject}"
      }
      on_error => "subject_not_found"
    }
    if ![subject_not_found] and [subject] != "" {
      mutate {
        replace => {
          "subject_labels.key" => "subject"
        }
      }
      mutate {
        merge => {
          "token_entity.resource.attribute.labels" => "subject_labels"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > entity > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or
    [interval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN DEVICES
  else if [_path] == "known_devices" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "RESOURCE"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_devices_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_devices_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_devices_security_result.detection_fields" =>
          "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_devices_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.asset.ip" => "host_ip"
        }
      }
    }

    grok {
      match => {
        "mac" => "%{MAC:mac}"
      }
      overwrite => ["mac"]
      on_error => "mac_not_vaild"
    }

    if ![mac_not_vaild] {
      mutate {
        merge => {
          "token_entity.asset.mac" => "mac"
        }
        on_error => "mac_merge_failure"
      }
    }

    mutate {
      replace => {
        "var_hardware.manufacturer" => "%{vendor_mac}"
      }
      on_error => "vendor_mac_not_found"
    }
    if ![vendor_mac_not_found] {
      mutate {
        merge => {
          "token_entity.asset.hardware" => "var_hardware"
        }
        on_error => "vendor_mac_not_found"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "token_entity.asset.first_seen_time"
      on_error => "ts_not_found"
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    for i,protocol in protocols {
      mutate {
        replace => {
          "protocol_labels" => ""
        }
      }
      mutate {
        replace => {
          "protocol_labels.value" => "%{protocol}"
        }
        on_error => "protocol_not_found"
      }
      if ![protocol_not_found] and [protocol] != "" {
        mutate {
          replace => {
            "protocol_labels.key" => "protocol"
          }
        }
        mutate {
          merge => {
            "token_entity.labels" => "protocol_labels"
          }
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > entity > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or
    [interval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN DOMAIN
  else if [_path] == "known_domains" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
        "required_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "DOMAIN_NAME"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_domains_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_domains_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_domains_security_result.detection_fields" =>
          "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_domains_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    mutate {
      replace => {
        "token_entity.domain.name" => "%{domain}"
      }
      on_error => "domain_not_found"
    }

    # Duplicating the domain into host name to skip the validation for DOMAIN_NAME entity type
    mutate {
      replace => {
        "token_entity.hostname" => "%{domain}"
      }
      on_error => "domain_not_found"
    }
    if ![domain_not_found] {
      mutate {
        replace => {
          "required_not_found" => "false"
        }
      }
    }

    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
    }

    date {
      match => ["ts", "RFC3339" ]
      target => "token_entity.domain.first_seen_time"
      on_error => "ts_not_found"
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    for i,protocol in protocols {
      mutate {
        replace => {
          "protocol_labels" => ""
        }
      }
      mutate {
        replace => {
          "protocol_labels.value" => "%{protocol}"
        }
        on_error => "protocol_not_found"
      }
      if ![protocol_not_found] and [protocol] != "" {
        mutate {
          replace => {
            "protocol_labels.key" => "protocol"
          }
        }
        mutate {
          merge => {
            "token_entity.labels" => "protocol_labels"
          }
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > entity > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or [interval_start_time_not_found] == "true"
    or [required_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN HOSTS
  else if [_path] == "known_hosts" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
        "required_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.description" => "%{ep.desc}"
      }
      on_error => "ep_desc_not_found"
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "IP_ADDRESS"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_hosts_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "conns_opened" => "string"
      }
      on_error => "conns_opened_conversion_error"
    }

    mutate {
      replace => {
        "conns_opened_labels.value" => "%{conns_opened}"
      }
      on_error => "conns_opened_not_found"
    }
    if ![conns_opened_not_found] and [conns_opened] != "" {
      mutate {
        replace => {
          "conns_opened_labels.key" => "conns_opened"
        }
      }
      mutate {
        merge => {
          "known_hosts_security_result.detection_fields" =>
          "conns_opened_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "conns_closed" => "string"
      }
      on_error => "conns_closed_conversion_error"
    }

    mutate {
      replace => {
        "conns_closed_labels.value" => "%{conns_closed}"
      }
      on_error => "conns_closed_not_found"
    }
    if ![conns_closed_not_found] and [conns_closed] != "" {
      mutate {
        replace => {
          "conns_closed_labels.key" => "conns_closed"
        }
      }
      mutate {
        merge => {
          "known_hosts_security_result.detection_fields" =>
          "conns_closed_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "conns_pending" => "string"
      }
      on_error => "conns_pending_conversion_error"
    }

    mutate {
      replace => {
        "conns_pending_labels.value" => "%{conns_pending}"
      }
      on_error => "conns_pending_not_found"
    }
    if ![conns_pending_not_found] and [conns_pending] != "" {
      mutate {
        replace => {
          "conns_pending_labels.key" => "conns_pending"
        }
      }
      mutate {
        merge => {
          "known_hosts_security_result.detection_fields" =>
          "conns_pending_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_hosts_security_result.detection_fields" =>
          "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_hosts_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
      mutate {
        replace => {
          "required_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    mutate {
      replace => {
        "token_entity.platform_version" => "%{ep.os_version}"
      }
      on_error => "ep_os_version_not_found"
    }

    # UDM > entity > security_result
    mutate {
      convert => {
        "ep.criticality" => "string"
      }
      on_error => "ep_criticality_conversion_error"
    }

    mutate {
      replace => {
        "ep_criticatility_label.value" => "%{ep.criticality}"
      }
      on_error => "ep_criticatility_not_found"
    }

    if ![ep_criticatility_not_found] and [ep_criticatility_label][value] != "" {
      mutate {
        replace => {
          "ep_criticatility_label.key" => "ep_criticatility"
        }
      }

      mutate {
        merge => {
          "sresult.detection_fields" => "ep_criticatility_label"
        }
        on_error => "failed_to_merge_ep_criticatility_label"
        remove_field => ["ep_criticatility_label"]
      }
    }

    mutate {
      merge => {
        "token_entity.security_result" => "sresult"
      }
      on_error => "failed_to_merge_security_result"
      remove_field => ["sresult"]
    }

    # UDM > additional
    mutate {
      convert => {
        "ep.cid" => "string"
      }
      on_error => "ep_cid_conversion_error"
    }

    mutate {
      replace => {
        "ep_cid_label.value.string_value" => "%{ep.cid}"
      }
      on_error => "ep_cid_not_found"
    }

    if ![ep_cid_not_found] and
      [ep_cid_label][value][string_value] != "" {
      mutate {
        replace => {
          "ep_cid_label.key" => "ep_cid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "ep_cid_label"
        }
      }
    }

    mutate {
      convert => {
        "ep.source" => "string"
      }
      on_error => "ep_source_conversion_error"
    }

    mutate {
      replace => {
        "ep_source_label.value.string_value" => "%{ep.source}"
      }
      on_error => "ep_source_not_found"
    }

    if ![ep_source_not_found] and
      [ep_source_label][value][string_value] != "" {
      mutate {
        replace => {
          "ep_source_label.key" => "ep_source"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "ep_source_label"
        }
      }
    }

    mutate {
      convert => {
        "ep.status" => "string"
      }
      on_error => "ep_status_conversion_error"
    }

    mutate {
      replace => {
        "ep_status_label.value.string_value" => "%{ep.status}"
      }
      on_error => "ep_status_not_found"
    }

    if ![ep_status_not_found] and
      [ep_status_label][value][string_value] != "" {
      mutate {
        replace => {
          "ep_status_label.key" => "ep_status"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "ep_status_label"
        }
      }
    }

    mutate {
      convert => {
        "ep.uid" => "string"
      }
      on_error => "ep_uid_conversion_error"
    }

    mutate {
      replace => {
        "ep_uid_label.value.string_value" => "%{ep.uid}"
      }
      on_error => "ep_uid_not_found"
    }

    if ![ep_uid_not_found] and
      [ep_uid_label][value][string_value] != "" {
      mutate {
        replace => {
          "ep_uid_label.key" => "ep_uid"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "ep_uid_label"
        }
      }
    }

    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or [interval_start_time_not_found] == "true"
    or [required_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN NAMES
  else if [_path] == "known_names" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "RESOURCE"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_names_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_names_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_names_security_result.detection_fields" => "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_names_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
    }

    mutate {
      replace => {
        "token_entity.hostname" => "%{hostname}"
      }
      on_error => "hostname_not_found"
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    for i,protocol in protocols {
      mutate {
        replace => {
          "protocol_labels" => ""
        }
      }
      mutate {
        replace => {
          "protocol_labels.value" => "%{protocol}"
        }
        on_error => "protocol_not_found"
      }
      if ![protocol_not_found] and [protocol] != "" {
        mutate {
          replace => {
            "protocol_labels.key" => "protocol"
          }
        }
        mutate {
          merge => {
            "token_entity.labels" => "protocol_labels"
          }
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > entity > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or
    [interval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN REMOTES
  else if [_path] == "known_remotes" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
        "required_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "IP_ADDRESS"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_remotes_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_remotes_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_remotes_security_result.detection_fields" =>
          "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_remotes_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
      mutate {
        replace => {
          "required_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > entity > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or [interval_start_time_not_found] == "true"
    or [required_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN SERVICES
  else if [_path] == "known_services" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "RESOURCE"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_services_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_services_security_result.detection_fields" =>
          "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_services_security_result.detection_fields" =>
          "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_services_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
    }

    mutate {
      convert => {
        "port" => "integer"
      }
      on_error => "port_num_conversion_failed"
    }

    mutate {
      rename => {
        "port" => "token_entity.port"
      }
    }

    mutate {
      convert => {
        "port_num" => "integer"
      }
      on_error => "port_num_conversion_failed"
    }

    mutate {
      rename => {
        "port_num" => "token_entity.port"
      }
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    for i,protocol in protocols {
      mutate {
        replace => {
          "protocol_labels" => ""
        }
      }
      mutate {
        replace => {
          "protocol_labels.value" => "%{protocol}"
        }
        on_error => "protocol_not_found"
      }
      if ![protocol_not_found] and [protocol] != "" {
        mutate {
          replace => {
            "protocol_labels.key" => "protocol"
          }
        }
        mutate {
          merge => {
            "token_entity.labels" => "protocol_labels"
          }
        }
      }
    }

    for i,var_service in service {
      mutate {
        replace => {
          "var_service_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_service_labels.value" => "%{var_service}"
        }
        on_error => "var_service_not_found"
      }
      if ![var_service_not_found] and [var_service] != "" {
        mutate {
          replace => {
            "var_service_labels.key" => "service"
          }
        }
        mutate {
          merge => {
            "token_entity.labels" => "var_service_labels"
          }
        }
      }
    }

    for i,var_software in software {
      mutate {
        replace => {
          "token_software" => ""
        }
      }
      mutate {
        replace => {
          "token_software.name" => "%{var_software}"
        }
        on_error => "var_software_not_found"
      }
      mutate {
        merge => {
          "token_entity.asset.software" => "token_software"
        }
        on_error => "token_software_merge_failure"
      }
    }

    for index,var_app in app {
      if [index] == 0 {
        mutate {
          replace => {
            "token_entity.application" => "%{var_app}"
          }
          on_error => "var_app_not_found"
        }
      }
      else {
        mutate {
          replace => {
            "var_app_labels" => ""
          }
        }
        mutate {
          replace => {
            "var_app_labels.value" => "%{var_app}"
          }
          on_error => "var_app_not_found"
        }
        if ![var_app_not_found] and [var_app] != "" {
          mutate {
            replace => {
              "var_app_labels.key" => "app"
            }
          }
          mutate {
            merge => {
              "token_entity.labels" => "var_app_labels"
            }
          }
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    mutate {
      convert => {
        "num_conns_complete" => "string"
      }
      on_error => "num_conns_complete_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_complete_label.value" => "%{num_conns_complete}"
      }
      on_error => "num_conns_complete_not_found"
    }

    if ![num_conns_complete_not_found] and
      [num_conns_complete_label][value] != "" {
      mutate {
        replace => {
          "num_conns_complete_label.key" => "num_conns_complete"
        }
      }
      mutate {
        merge => {
          "sresult.detection_fields" =>
          "num_conns_complete_label"
        }
        remove_field => ["num_conns_complete_label"]
      }
    }

    mutate {
      convert => {
        "num_conns_pending" => "string"
      }
      on_error => "num_conns_pending_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_pending_label.value" => "%{num_conns_pending}"
      }
      on_error => "num_conns_pending_not_found"
    }

    if ![num_conns_pending_not_found] and
      [num_conns_pending_label][value] != "" {
      mutate {
        replace => {
          "num_conns_pending_label.key" => "num_conns_pending"
        }
      }
      mutate {
        merge => {
          "sresult.detection_fields" =>
          "num_conns_pending_label"
        }
        remove_field => ["num_conns_pending_label"]
      }
    }

    mutate {
      merge => {
        "token_entity.security_result" => "sresult"
      }
      on_error => "failed_to_merge_security_result"
      remove_field => ["sresult"]
    }

    # UDM > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or
    [interval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # KNOWN USERS
  else if [_path] == "known_users" {

    mutate {
      replace => {
        "entity_metadata.vendor_name" => "Corelight"
      }
    }

    mutate {
      replace => {
        "entity_metadata.product_name" => "Zeek"
      }
    }

    # UDM > Entity > Metadata
    mutate {
      replace => {
        "interval_start_time_not_found" => "true"
        "threat_not_found" => "true"
      }
    }
    date {
      match => ["ts", "RFC3339" ]
      target => "entity_metadata.interval.start_time"
      on_error => "ts_not_found"
    }
    if ![ts_not_found] {
      mutate {
        replace => {
          "interval_start_time_not_found" => "false"
        }
      }
    }

    mutate {
      replace => {
        "entity_metadata.entity_type" => "RESOURCE"
      }
    }

    for i,var_annotations in annotations {
      mutate {
        replace => {
          "var_annotations_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_annotations_labels.value" => "%{var_annotations}"
        }
        on_error => "var_annotations_not_found"
      }
      if ![var_annotations_not_found] and [var_annotations] != "" {
        mutate {
          replace => {
            "var_annotations_labels.key" => "annotations"
          }
        }
        mutate {
          merge => {
            "known_users_security_result.detection_fields" =>
            "var_annotations_labels"
          }
        }
        mutate {
          replace => {
            "threat_not_found" => "false"
          }
        }
      }
    }

    mutate {
      convert => {
        "num_conns" => "string"
      }
      on_error => "num_conns_conversion_error"
    }

    mutate {
      replace => {
        "num_conns_labels.value" => "%{num_conns}"
      }
      on_error => "num_conns_not_found"
    }
    if ![num_conns_not_found] and [num_conns] != "" {
      mutate {
        replace => {
          "num_conns_labels.key" => "num_conns"
        }
      }
      mutate {
        merge => {
          "known_users_security_result.detection_fields" => "num_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      convert => {
        "long_conns" => "string"
      }
      on_error => "long_conns_conversion_error"
    }

    mutate {
      replace => {
        "long_conns_labels.value" => "%{long_conns}"
      }
      on_error => "long_conns_not_found"
    }
    if ![long_conns_not_found] and [long_conns] != "" {
      mutate {
        replace => {
          "long_conns_labels.key" => "long_conns"
        }
      }
      mutate {
        merge => {
          "known_users_security_result.detection_fields" => "long_conns_labels"
        }
      }
      mutate {
        replace => {
          "threat_not_found" => "false"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "known_users_security_result"
      }
      on_error => "failed_to_merge_security_result"
    }

    # UDM > Entity > Entity
    grok {
      match => {
        "host_ip" => "%{IP:host_ip}"
      }
      overwrite => ["host_ip"]
      on_error => "host_ip_not_ip"
    }
    if ![host_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "host_ip"
        }
      }
    }

    grok {
      match => {
        "remote_ip" => "%{IP:remote_ip}"
      }
      overwrite => ["remote_ip"]
      on_error => "remote_ip_not_ip"
    }
    if ![remote_ip_not_ip] {
      mutate {
        merge => {
          "token_entity.ip" => "remote_ip"
        }
      }
    }

    mutate {
      replace => {
        "token_entity.user.user_display_name" => "%{user}"
      }
      on_error => "user_not_found"
    }

    mutate {
      convert => {
        "duration" => "string"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      replace => {
        "duration_labels.value" => "%{duration}"
      }
      on_error => "duration_not_found"
    }
    if ![duration_not_found] and [duration] != "" {
      mutate {
        replace => {
          "duration_labels.key" => "duration"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "duration_labels"
        }
      }
    }

    mutate {
      replace => {
        "kuid_labels.value" => "%{kuid}"
      }
      on_error => "kuid_not_found"
    }
    if ![kuid_not_found] and [kuid] != "" {
      mutate {
        replace => {
          "kuid_labels.key" => "kuid"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "kuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "last_active_interval" => "string"
      }
      on_error => "last_active_interval_conversion_error"
    }

    mutate {
      replace => {
        "last_active_interval_labels.value" => "%{last_active_interval}"
      }
      on_error => "last_active_interval_not_found"
    }
    if ![last_active_interval_not_found] and [last_active_interval] != "" {
      mutate {
        replace => {
          "last_active_interval_labels.key" => "last_active_interval"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_interval_labels"
        }
      }
    }

    mutate {
      replace => {
        "last_active_session_labels.value" => "%{last_active_session}"
      }
      on_error => "last_active_session_not_found"
    }
    if ![last_active_session_not_found] and [last_active_session] != "" {
      mutate {
        replace => {
          "last_active_session_labels.key" => "last_active_session"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "last_active_session_labels"
        }
      }
    }

    mutate {
      replace => {
        "protocol_labels.value" => "%{protocol}"
      }
      on_error => "protocol_not_found"
    }
    if ![protocol_not_found] and [protocol] != "" {
      mutate {
        replace => {
          "protocol_labels.key" => "protocol"
        }
      }
      mutate {
        merge => {
          "token_entity.labels" => "protocol_labels"
        }
      }
    }

    mutate {
      rename => {
        "token_security_result" => "entity_metadata.threat"
      }
    }

    # UDM > additional
    mutate {
      convert => {
        "host_inner_vlan" => "string"
      }
      on_error => "host_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_inner_vlan_label.value.string_value" => "%{host_inner_vlan}"
      }
      on_error => "host_inner_vlan_not_found"
    }

    if ![host_inner_vlan_not_found] and
      [host_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_inner_vlan_label.key" => "host_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "host_vlan" => "string"
      }
      on_error => "host_vlan_conversion_error"
    }

    mutate {
      replace => {
        "host_vlan_label.value.string_value" => "%{host_vlan}"
      }
      on_error => "host_vlan_not_found"
    }

    if ![host_vlan_not_found] and
      [host_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "host_vlan_label.key" => "host_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "host_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "remote_inner_vlan" => "string"
      }
      on_error => "remote_inner_vlan_conversion_error"
    }

    mutate {
      replace => {
        "remote_inner_vlan_label.value.string_value" =>
        "%{remote_inner_vlan}"
      }
      on_error => "remote_inner_vlan_not_found"
    }

    if ![remote_inner_vlan_not_found] and
      [remote_inner_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "remote_inner_vlan_label.key" => "remote_inner_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "remote_inner_vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "remote_vlan" => "string"
      }
      on_error => "remote_vlan_conversion_error"
    }

    mutate {
      replace => {
        "remote_vlan_label.value.string_value" => "%{remote_vlan}"
      }
      on_error => "remote_vlan_not_found"
    }

    if ![remote_vlan_not_found] and
      [remote_vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "remote_vlan_label.key" => "remote_vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "remote_vlan_label"
        }
      }
    }

    # Check if required udm validation fields for entity and ioc exist. if required field not exist drop entity and ioc event.
    if [threat_not_found] == "true" or
    [interval_start_time_not_found] == "true" {
      drop {
        tag => "TAG_UNSUPPORTED"
      }
    }

    mutate {
      rename => {
        "entity_metadata" => "event1.idm.entity.metadata"
        "token_entity" => "event1.idm.entity.entity"
        "token_additional" => "event1.idm.entity.additional"
      }
    }
  }

  # ----------------------------------------------------------------------
  # WEIRD, WEIRD RED
  else if [_path] == "weird" or [_path] == "weird_red" {

    # UDM > About
    mutate {
      replace => {
        "name_labels.value" => "%{name}"
      }
      on_error => "name_not_found"
    }
    if ![name_not_found] and [name] != "" {
      mutate {
        replace => {
          "name_labels.key" => "name"
        }
      }
      mutate {
        merge => {
          "weird_about.labels" => "name_labels"
        }
      }
    }

    mutate {
      replace => {
        "addl_labels.value" => "%{addl}"
      }
      on_error => "addl_not_found"
    }
    if ![addl_not_found] and [addl] != "" {
      mutate {
        replace => {
          "addl_labels.key" => "addl"
        }
      }
      mutate {
        merge => {
          "weird_about.labels" => "addl_labels"
        }
      }
    }

    mutate {
      convert => {
        "notice" => "string"
      }
      on_error => "notice_conversion_error"
    }

    mutate {
      replace => {
        "notice_labels.value" => "%{notice}"
      }
      on_error => "notice_not_found"
    }
    if ![notice_not_found] and [notice] != "" {
      mutate {
        replace => {
          "notice_labels.key" => "notice"
        }
      }
      mutate {
        merge => {
          "weird_about.labels" => "notice_labels"
        }
      }
    }

    mutate {
      replace => {
        "peer_labels.value" => "%{peer}"
      }
      on_error => "peer_not_found"
    }
    if ![peer_not_found] and [peer] != "" {
      mutate {
        replace => {
          "peer_labels.key" => "peer"
        }
      }
      mutate {
        merge => {
          "weird_about.labels" => "peer_labels"
        }
      }
    }

    mutate {
      replace => {
        "source_labels.value" => "%{source}"
      }
      on_error => "source_not_found"
    }
    if ![source_not_found] and [source] != "" {
      mutate {
        replace => {
          "source_labels.key" => "source"
        }
      }
      mutate {
        merge => {
          "weird_about.labels" => "source_labels"
        }
      }
    }

    mutate {
      merge => {
        "weird_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "weird_about"
      }
      on_error => "weird_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # WIREGUARD
  else if [_path] == "wireguard" {

    # UDM > About
    mutate {
      convert => {
        "established" => "string"
      }
      on_error => "established_conversion_error"
    }

    mutate {
      replace => {
        "established_labels.value" => "%{established}"
      }
      on_error => "established_not_found"
    }
    if ![established_not_found] and [established] != "" {
      mutate {
        replace => {
          "established_labels.key" => "established"
        }
      }
      mutate {
        merge => {
          "wireguard_about.labels" => "established_labels"
        }
      }
    }

    mutate {
      convert => {
        "initiations" => "string"
      }
      on_error => "initiations_conversion_error"
    }

    mutate {
      replace => {
        "initiations_labels.value" => "%{initiations}"
      }
      on_error => "initiations_not_found"
    }
    if ![initiations_not_found] and [initiations] != "" {
      mutate {
        replace => {
          "initiations_labels.key" => "initiations"
        }
      }
      mutate {
        merge => {
          "wireguard_about.labels" => "initiations_labels"
        }
      }
    }

    mutate {
      convert => {
        "responses" => "string"
      }
      on_error => "responses_conversion_error"
    }

    mutate {
      replace => {
        "responses_labels.value" => "%{responses}"
      }
      on_error => "responses_not_found"
    }
    if ![responses_not_found] and [responses] != "" {
      mutate {
        replace => {
          "responses_labels.key" => "responses"
        }
      }
      mutate {
        merge => {
          "wireguard_about.labels" => "responses_labels"
        }
      }
    }

    mutate {
      merge => {
        "wireguard_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "wireguard_about"
      }
      on_error => "wireguard_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # X509, X509 RED
  else if [_path] == "x509" or [_path] == "x509_red" {

    # UDM > Network
    mutate {
      convert => {
        "certificate.version" => "string"
      }
      on_error => "certificate_version_conversion_failed"
    }
    mutate {
      replace => {
        "token_network.tls.server.certificate.version" =>
        "%{certificate.version}"
      }
      on_error => "certificate_version_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.server.certificate.serial" => "%{certificate.serial}"
      }
      on_error => "certificate_serial_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.server.certificate.subject" =>
        "%{certificate.subject}"
      }
      on_error => "certificate_subject_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.server.certificate.issuer" =>
        "%{certificate.issuer}"
      }
      on_error => "certificate_issuer_not_found"
    }

    date {
      match => ["certificate.not_valid_before", "RFC3339" ]
      target => "token_network.tls.server.certificate.not_before"
      on_error => "certificate_not_valid_before_not_found"
    }

    date {
      match => ["certificate.not_valid_after", "RFC3339" ]
      target => "token_network.tls.server.certificate.not_after"
      on_error => "certificate_not_valid_after_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.curve" => "%{certificate.curve}"
      }
      on_error => "certificate_curve_not_found"
    }

    # UDM > About
    for i,var_uri in san.uri {
      mutate {
        replace => {
          "var_about" => ""
        }
      }
      mutate {
        replace => {
          "var_about.url" => "%{var_uri}"
        }
        on_error => "uri_not_found"
      }
      mutate {
        merge => {
          "token_about" => "var_about"
        }
        on_error => "var_about_not_found"
      }
    }

    for i,var_ip in san.ip {
      grok {
        match => {
          "var_ip" => "%{IP:var_ip}"
        }
        overwrite => ["var_ip"]
        on_error => "var_ip_not_ip"
      }
      if ![var_ip_not_ip] {
        mutate {
          merge => {
            "x509_about.ip" => "var_ip"
          }
        }
      }
    }

    mutate {
      replace => {
        "fingerprint_labels.value" => "%{fingerprint}"
      }
      on_error => "fingerprint_not_found"
    }
    if ![fingerprint_not_found] and [fingerprint] != "" {
      mutate {
        replace => {
          "fingerprint_labels.key" => "fingerprint"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "fingerprint_labels"
        }
      }
    }

    mutate {
      replace => {
        "certificate_key_alg_labels.value" => "%{certificate.key_alg}"
      }
      on_error => "certificate_key_alg_not_found"
    }
    if ![certificate_key_alg_not_found] and [certificate][key_alg] != "" {
      mutate {
        replace => {
          "certificate_key_alg_labels.key" => "certificate_key_alg"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "certificate_key_alg_labels"
        }
      }
    }

    mutate {
      replace => {
        "certificate_sig_alg_labels.value" => "%{certificate.sig_alg}"
      }
      on_error => "certificate_sig_alg_not_found"
    }
    if ![certificate_sig_alg_not_found] and [certificate][sig_alg] != "" {
      mutate {
        replace => {
          "certificate_sig_alg_labels.key" => "certificate_sig_alg"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "certificate_sig_alg_labels"
        }
      }
    }

    mutate {
      replace => {
        "certificate_key_type_labels.value" => "%{certificate.key_type}"
      }
      on_error => "certificate_key_type_not_found"
    }
    if ![certificate_key_type_not_found] and [certificate][key_type] != "" {
      mutate {
        replace => {
          "certificate_key_type_labels.key" => "certificate_key_type"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "certificate_key_type_labels"
        }
      }
    }

    mutate {
      convert => {
        "certificate.key_length" => "string"
      }
      on_error => "certificate_key_length_conversion_error"
    }

    mutate {
      replace => {
        "certificate_key_length_labels.value" => "%{certificate.key_length}"
      }
      on_error => "certificate_key_length_not_found"
    }
    if ![certificate_key_length_not_found] and [certificate][key_length] != "" {
      mutate {
        replace => {
          "certificate_key_length_labels.key" => "certificate_key_length"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "certificate_key_length_labels"
        }
      }
    }

    mutate {
      replace => {
        "certificate_exponent_labels.value" => "%{certificate.exponent}"
      }
      on_error => "certificate_exponent_not_found"
    }
    if ![certificate_exponent_not_found] and [certificate][exponent] != "" {
      mutate {
        replace => {
          "certificate_exponent_labels.key" => "certificate_exponent"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "certificate_exponent_labels"
        }
      }
    }

    mutate {
      convert => {
        "basic_constraints.ca" => "string"
      }
      on_error => "basic_constraints_ca_conversion_error"
    }

    mutate {
      replace => {
        "basic_constraints_ca_labels.value" => "%{basic_constraints.ca}"
      }
      on_error => "basic_constraints_ca_not_found"
    }
    if ![basic_constraints_ca_not_found] and [basic_constraints][ca] != "" {
      mutate {
        replace => {
          "basic_constraints_ca_labels.key" => "basic_constraints_ca"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "basic_constraints_ca_labels"
        }
      }
    }

    mutate {
      convert => {
        "basic_constraints.path_len" => "string"
      }
      on_error => "basic_constraints_path_len_conversion_error"
    }

    mutate {
      replace => {
        "basic_constraints_path_len_labels.value" =>
        "%{basic_constraints.path_len}"
      }
      on_error => "basic_constraints_path_len_not_found"
    }
    if ![basic_constraints_path_len_not_found] and
    [basic_constraints][path_len] != "" {
      mutate {
        replace => {
          "basic_constraints_path_len_labels.key" =>
          "basic_constraints_path_len"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "basic_constraints_path_len_labels"
        }
      }
    }

    mutate {
      convert => {
        "host_cert" => "string"
      }
      on_error => "host_cert_conversion_error"
    }

    mutate {
      replace => {
        "host_cert_labels.value" => "%{host_cert}"
      }
      on_error => "host_cert_not_found"
    }
    if ![host_cert_not_found] and [host_cert] != "" {
      mutate {
        replace => {
          "host_cert_labels.key" => "host_cert"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "host_cert_labels"
        }
      }
    }

    mutate {
      convert => {
        "client_cert" => "string"
      }
      on_error => "client_cert_conversion_error"
    }

    mutate {
      replace => {
        "client_cert_labels.value" => "%{client_cert}"
      }
      on_error => "client_cert_not_found"
    }
    if ![client_cert_not_found] and [client_cert] != "" {
      mutate {
        replace => {
          "client_cert_labels.key" => "client_cert"
        }
      }
      mutate {
        merge => {
          "x509_about.labels" => "client_cert_labels"
        }
      }
    }

    for i,var_dns in san.dns {
      mutate {
        replace => {
          "var_dns_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_dns_labels.value" => "%{var_dns}"
        }
        on_error => "var_dns_not_found"
      }
      if ![var_dns_not_found] and [var_dns] != "" {
        mutate {
          replace => {
            "var_dns_labels.key" => "san_dns"
          }
        }
        mutate {
          merge => {
            "x509_about.labels" => "var_dns_labels"
          }
        }
      }
    }

    for i,var_email in san.email {
      mutate {
        replace => {
          "var_email_labels" => ""
        }
      }
      mutate {
        replace => {
          "var_email_labels.value" => "%{var_email}"
        }
        on_error => "var_email_not_found"
      }
      if ![var_email_not_found] and [var_email] != "" {
        mutate {
          replace => {
            "var_email_labels.key" => "san_email"
          }
        }
        mutate {
          merge => {
            "x509_about.labels" => "var_email_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "x509_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "x509_about"
      }
      on_error => "x509_about_not_found"
    }

    # UDM > additional
    mutate {
      convert => {
        "vlan" => "string"
      }
      on_error => "vlan_conversion_error"
    }

    mutate {
      replace => {
        "vlan_label.value.string_value" => "%{vlan}"
      }
      on_error => "vlan_not_found"
    }

    if ![vlan_not_found] and [vlan_label][value][string_value] != "" {
      mutate {
        replace => {
          "vlan_label.key" => "vlan"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "vlan_label"
        }
      }
    }

    mutate {
      convert => {
        "vlan_inner" => "string"
      }
      on_error => "vlan_inner_conversion_error"
    }

    mutate {
      replace => {
        "vlan_inner_label.value.string_value" => "%{vlan_inner}"
      }
      on_error => "vlan_inner_not_found"
    }

    if ![vlan_inner_not_found] and
      [vlan_inner_label][value][string_value] != "" {
      mutate {
        replace => {
          "vlan_inner_label.key" => "vlan_inner"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "vlan_inner_label"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Mysql

  else if [_path] == "mysql" {

    # UDM > Principal
    mutate {
      replace => {
        "token_principal.process.command_line" => "%{arg}"
      }
      on_error => "arg_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "cmd_labels.value" => "%{cmd}"
      }
      on_error => "cmd_not_found"
    }

    if ![cmd_not_found] and [cmd] != "" {
      mutate {
        replace => {
          "cmd_labels.key" => "cmd"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "cmd_labels"
        }
      }
    }

    mutate {
      replace => {
        "response_labels.value" => "%{response}"
      }
      on_error => "response_not_found"
    }

    if ![response_not_found] and [response] != "" {
      mutate {
        replace => {
          "response_labels.key" => "response"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "response_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_target.resource.resource_type" => "DATABASE"
      }
    }

    mutate {
      convert => {
        "success" => "string"
      }
      on_error => "success_conversion_error"
    }

    mutate {
      replace => {
        "success_labels.value" => "%{success}"
      }
      on_error => "success_not_found"
    }
    if ![success_not_found] and [success] != "" {
      mutate {
        replace => {
          "success_labels.key" => "success"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "success_labels"
        }
      }
    }

    mutate {
      convert => {
        "rows" => "string"
      }
      on_error => "rows_conversion_error"
    }

    mutate {
      replace => {
        "rows_labels.value" => "%{rows}"
      }
      on_error => "rows_not_found"
    }
    if ![rows_not_found] and [rows] != "" {
      mutate {
        replace => {
          "rows_labels.key" => "rows"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "rows_labels"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "mysql_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "mysql_token_about"
      }
      on_error => "token_about_not_set"
    }

    # UDM > Metadata

    mutate {
      replace => {
        "token_metadata.event_type" => "USER_RESOURCE_ACCESS"
      }
    }
  }

  # ----------------------------------------------------------------------
  # Napatech_shunting

  else if [_path] == "napatech_shunting" {

    # UDM > Security Result

    mutate {
      convert => {
        "shunted_flows" => "string"
      }
      on_error => "terminated_flows_conversion_error"
    }

    mutate {
      replace => {
        "shunted_flows_labels.value" => "%{shunted_flows}"
      }
      on_error => "shunted_flows_not_found"
    }

    if ![shunted_flows_not_found] and [shunted_flows] != "" {
      mutate {
        replace => {
          "shunted_flows_labels.key" => "shunted_flows"
        }
      }
      mutate {
        merge => {
          "napatech_token_security_result.detection_fields" =>
          "shunted_flows_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "napatech_token_security_result"
      }
      on_error => "napatech_token_security_result_not_found"
    }

    # UDM > About

    mutate {
      convert => {
        "terminated_flows" => "string"
      }
      on_error => "terminated_flows_conversion_error"
    }

    mutate {
      replace => {
        "terminated_flows_labels.value" => "%{terminated_flows}"
      }
      on_error => "terminated_flows_not_found"
    }

    if ![terminated_flows_not_found] and [terminated_flows] != "" {
      mutate {
        replace => {
          "terminated_flows_labels.key" => "terminated_flows"
        }
      }
      mutate {
        merge => {
          "napatech_token_about.labels" => "terminated_flows_labels"
        }
      }
    }

    mutate {
      replace => {
        "peer_labels.value" => "%{peer}"
      }
      on_error => "peer_not_found"
    }

    if ![peer_not_found] and [peer] != "" {
      mutate {
        replace => {
          "peer_labels.key" => "peer"
        }
      }
      mutate {
        merge => {
          "napatech_token_about.labels" => "peer_labels"
        }
      }
    }

    mutate {
      merge => {
        "napatech_token_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "napatech_token_about"
      }
      on_error => "token_about_not_set"
    }
  }

  # ----------------------------------------------------------------------
  # Ntlm

  else if [_path] == "ntlm" {

    # UDM > Extension

    mutate {
      replace => {
        "extension_present" => "false"
      }
    }

    mutate {
      convert => {
        "success" => "string"
      }
      on_error => "success_conversion_error"
    }

    mutate {
      replace => {
        "check_success" => "%{success}"
      }
      on_error => "success_not_found"
    }

    if ![success_not_found] and [success] != "" {
      if [success] == "true" {
        mutate {
          replace => {
            "token_extensions.auth.auth_details" => "Authentication successful"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_extensions.auth.auth_details" => "Authentication failed"
          }
        }
      }
      mutate {
        replace => {
          "extension_present" => "true"
        }
      }
    }

    # UDM > Principal

    mutate {
      replace => {
        "token_principal.domain.name" => "%{domainname}"
      }
      on_error => "domainname_not_found"
    }

    mutate {
      replace => {
        "token_principal.hostname" => "%{hostname}"
      }
      on_error => "hostname_not_found"
    }

    if ![hostname_not_found] or ![domainname_not_found] {
      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "token_target.domain.name" => "%{server_dns_computer_name}"
      }
      on_error => "server_dns_computer_name_not_found"
    }

    mutate {
      replace => {
        "token_target.hostname" => "%{server_nb_computer_name}"
      }
      on_error => "server_nb_computer_name_not_found"
    }

    mutate {
      replace => {
        "token_target.user.userid" => "%{username}"
      }
      on_error => "username_not_found"
    }

    if ![server_dns_computer_name_not_found] or
    ![server_nb_computer_name_not_found] or ![username_not_found] {
      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "server_tree_name_labels.value" => "%{server_tree_name}"
      }
      on_error => "server_tree_name_not_found"
    }

    if ![server_tree_name_not_found] and [server_tree_name] != "" {
      mutate {
        replace => {
          "server_tree_name_labels.key" => "server_tree_name"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "server_tree_name_labels"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "ntlm_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "ntlm_about"
      }
      on_error => "token_about_not_set"
    }

    # Check if required udm validation fields for USER_LOGIN exist, if not set as STATUS_UPDATE
    if [extension_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "USER_LOGIN"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Ntp

  else if [_path] == "ntp" {

    # UDM > Network

    mutate {
      replace => {
        "token_network.application_protocol" => "NTP"
      }
    }

    mutate {
      convert => {
        "version" => "string"
      }
      on_error => "version_conversion_error"
    }

    mutate {
      replace => {
        "token_network.application_protocol_version" => "%{version}"
      }
      on_error => "version_not_found"
    }

    mutate {
      replace => {
        "token_network.ip_protocol" => "UDP"
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "check_ref_id" => "%{ref_id}"
      }
      on_error => "ref_id_not_found"
    }

    mutate {
      convert => {
        "check_ref_id" => "ipaddress"
      }
      on_error => "ref_id_not_ip"
    }
    if ![ref_id_not_ip] {
      mutate {
        merge => {
          "token_target.ip" => "ref_id"
        }
        on_error => "token_target_present"
      }
      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "ntp_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "mode" => "string"
      }
      on_error => "mode_conversion_error"
    }

    mutate {
      replace => {
        "mode_labels.value" => "%{mode}"
      }
      on_error => "mode_not_found"
    }
    if ![mode_not_found] and [mode] != "" {
      mutate {
        replace => {
          "mode_labels.key" => "mode"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "mode_labels"
        }
      }
    }

    mutate {
      convert => {
        "num_exts" => "string"
      }
      on_error => "num_exts_conversion_error"
    }

    mutate {
      replace => {
        "num_exts_labels.value" => "%{num_exts}"
      }
      on_error => "num_exts_not_found"
    }
    if ![num_exts_not_found] and [num_exts] != "" {
      mutate {
        replace => {
          "num_exts_labels.key" => "num_exts"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "num_exts_labels"
        }
      }
    }

    mutate {
      replace => {
        "org_time_labels.value" => "%{org_time}"
      }
      on_error => "org_time_not_found"
    }
    if ![org_time_not_found] and [org_time] != "" {
      mutate {
        replace => {
          "org_time_labels.key" => "org_time"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "org_time_labels"
        }
      }
    }

    mutate {
      convert => {
        "poll" => "string"
      }
      on_error => "poll_conversion_error"
    }

    mutate {
      replace => {
        "poll_labels.value" => "%{poll}"
      }
      on_error => "poll_not_found"
    }
    if ![poll_not_found] and [poll] != "" {
      mutate {
        replace => {
          "poll_labels.key" => "poll"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "poll_labels"
        }
      }
    }

    mutate {
      convert => {
        "precision" => "string"
      }
      on_error => "precision_conversion_error"
    }

    mutate {
      replace => {
        "precision_labels.value" => "%{precision}"
      }
      on_error => "precision_not_found"
    }
    if ![precision_not_found] and [precision] != "" {
      mutate {
        replace => {
          "precision_labels.key" => "precision"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "precision_labels"
        }
      }
    }

    mutate {
      replace => {
        "rec_time_labels.value" => "%{rec_time}"
      }
      on_error => "rec_time_not_found"
    }
    if ![rec_time_not_found] and [rec_time] != "" {
      mutate {
        replace => {
          "rec_time_labels.key" => "rec_time"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "rec_time_labels"
        }
      }
    }

    mutate {
      replace => {
        "xmt_time_labels.value" => "%{xmt_time}"
      }
      on_error => "xmt_time_not_found"
    }
    if ![xmt_time_not_found] and [xmt_time] != "" {
      mutate {
        replace => {
          "xmt_time_labels.key" => "rec_time"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "xmt_time_labels"
        }
      }
    }

    mutate {
      replace => {
        "ref_time_labels.value" => "%{ref_time}"
      }
      on_error => "ref_time_not_found"
    }
    if ![ref_time_not_found] and [ref_time] != "" {
      mutate {
        replace => {
          "ref_time_labels.key" => "ref_time"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "ref_time_labels"
        }
      }
    }

    mutate {
      convert => {
        "root_delay" => "string"
      }
      on_error => "root_delay_conversion_error"
    }

    mutate {
      replace => {
        "root_delay_labels.value" => "%{root_delay}"
      }
      on_error => "root_delay_not_found"
    }
    if ![root_delay_not_found] and [root_delay] != "" {
      mutate {
        replace => {
          "root_delay_labels.key" => "root_delay"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "root_delay_labels"
        }
      }
    }

    mutate {
      convert => {
        "root_disp" => "string"
      }
      on_error => "root_disp_conversion_error"
    }

    mutate {
      replace => {
        "root_disp_labels.value" => "%{root_disp}"
      }
      on_error => "root_disp_not_found"
    }
    if ![root_disp_not_found] and [root_disp] != "" {
      mutate {
        replace => {
          "root_disp_labels.key" => "root_disp"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "root_disp_labels"
        }
      }
    }

    mutate {
      convert => {
        "stratum" => "string"
      }
      on_error => "stratum_conversion_error"
    }

    mutate {
      replace => {
        "stratum_labels.value" => "%{stratum}"
      }
      on_error => "stratum_not_found"
    }
    if ![stratum_not_found] and [stratum] != "" {
      mutate {
        replace => {
          "stratum_labels.key" => "stratum"
        }
      }
      mutate {
        merge => {
          "ntp_about.labels" => "stratum_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "ntp_about"
      }
      on_error => "ntp_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Pe

  else if [_path] == "pe" {

    # UDM > Target

    mutate {
      replace => {
        "token_target.application" => "%{subsystem}"
      }
      on_error => "subsystem_not_found"
    }

    mutate {
      replace => {
        "check_os" => "%{os}"
      }
      on_error => "os_not_found"
    }

    if ![os_not_found] {
      if [os] =~ "(?i)win" {
        mutate {
          replace => {
            "token_target.platform" => "WINDOWS"
          }
        }
      }
      else if [os] =~ "(?i)linux" {
        mutate {
          replace => {
            "token_target.platform" => "LINUX"
          }
        }
      }
      else if [os] =~ "(?i)mac" or [os] =~ "(?i)osx" {
        mutate {
          replace => {
            "token_target.platform" => "MAC"
          }
        }
      }
    }

    mutate {
      replace => {
        "machine_labels.value" => "%{machine}"
      }
      on_error => "machine_not_found"
    }
    if ![machine_not_found] and [machine] != "" {
      mutate {
        replace => {
          "machine_labels.key" => "machine"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "machine_labels"
        }
      }
    }

    # UDM > About

    mutate {
      convert => {
        "has_cert_table" => "string"
      }
      on_error => "has_cert_table_conversion_error"
    }

    mutate {
      replace => {
        "has_cert_table_labels.value" => "%{has_cert_table}"
      }
      on_error => "has_cert_table_not_found"
    }
    if ![has_cert_table_not_found] and [has_cert_table] != "" {
      mutate {
        replace => {
          "has_cert_table_labels.key" => "has_cert_table"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "has_cert_table_labels"
        }
      }
    }

    mutate {
      convert => {
        "has_debug_data" => "string"
      }
      on_error => "has_debug_data_conversion_error"
    }

    mutate {
      replace => {
        "has_debug_data_labels.value" => "%{has_debug_data}"
      }
      on_error => "has_debug_data_not_found"
    }
    if ![has_debug_data_not_found] and [has_debug_data] != "" {
      mutate {
        replace => {
          "has_debug_data_labels.key" => "has_debug_data"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "has_debug_data_labels"
        }
      }
    }

    mutate {
      convert => {
        "has_export_table" => "string"
      }
      on_error => "has_export_table_conversion_error"
    }

    mutate {
      replace => {
        "has_export_table_labels.value" => "%{has_export_table}"
      }
      on_error => "has_export_table_not_found"
    }
    if ![has_export_table_not_found] and [has_export_table] != "" {
      mutate {
        replace => {
          "has_export_table_labels.key" => "has_export_table"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "has_export_table_labels"
        }
      }
    }

    mutate {
      convert => {
        "has_import_table" => "string"
      }
      on_error => "has_import_table_conversion_error"
    }

    mutate {
      replace => {
        "has_import_table_labels.value" => "%{has_import_table}"
      }
      on_error => "has_import_table_not_found"
    }
    if ![has_import_table_not_found] and [has_import_table] != "" {
      mutate {
        replace => {
          "has_import_table_labels.key" => "has_import_table"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "has_import_table_labels"
        }
      }
    }

    for section in section_names {

      mutate {
        replace => {
          "section_labels" => ""
        }
      }

      mutate {
        convert => {
          "section" => "string"
        }
        on_error => "section_conversion_error"
      }

      mutate {
        replace => {
          "section_labels.value" => "%{section}"
        }
        on_error => "section_not_found"
      }
      if ![section_not_found] and [section] != "" {
        mutate {
          replace => {
            "section_labels.key" => "section_names"
          }
        }
        mutate {
          merge => {
            "pe_about.labels" => "section_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "uses_aslr" => "string"
      }
      on_error => "uses_aslr_conversion_error"
    }

    mutate {
      replace => {
        "uses_aslr_labels.value" => "%{uses_aslr}"
      }
      on_error => "uses_aslr_not_found"
    }
    if ![uses_aslr_not_found] and [uses_aslr] != "" {
      mutate {
        replace => {
          "uses_aslr_labels.key" => "uses_aslr"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "uses_aslr_labels"
        }
      }
    }

    mutate {
      convert => {
        "uses_code_integrity" => "string"
      }
      on_error => "uses_code_integrity_conversion_error"
    }

    mutate {
      replace => {
        "uses_code_integrity_labels.value" => "%{uses_code_integrity}"
      }
      on_error => "uses_code_integrity_not_found"
    }
    if ![uses_code_integrity_not_found] and [uses_code_integrity] != "" {
      mutate {
        replace => {
          "uses_code_integrity_labels.key" => "uses_code_integrity"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "uses_code_integrity_labels"
        }
      }
    }

    mutate {
      convert => {
        "uses_dep" => "string"
      }
      on_error => "uses_dep_conversion_error"
    }

    mutate {
      replace => {
        "uses_dep_labels.value" => "%{uses_dep}"
      }
      on_error => "uses_dep_not_found"
    }
    if ![uses_dep_not_found] and [uses_dep] != "" {
      mutate {
        replace => {
          "uses_dep_labels.key" => "uses_dep"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "uses_dep_labels"
        }
      }
    }

    mutate {
      convert => {
        "uses_seh" => "string"
      }
      on_error => "uses_seh_conversion_error"
    }

    mutate {
      replace => {
        "uses_seh_labels.value" => "%{uses_seh}"
      }
      on_error => "uses_seh_not_found"
    }
    if ![uses_seh_not_found] and [uses_seh] != "" {
      mutate {
        replace => {
          "uses_seh_labels.key" => "uses_seh"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "uses_seh_labels"
        }
      }
    }

    mutate {
      replace => {
        "compile_ts_labels.value" => "%{compile_ts}"
      }
      on_error => "compile_ts_not_found"
    }
    if ![compile_ts_not_found] and [compile_ts] != "" {
      mutate {
        replace => {
          "compile_ts_labels.key" => "compile_ts"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "compile_ts_labels"
        }
      }
    }

    mutate {
      replace => {
        "id_labels.value" => "%{id}"
      }
      on_error => "id_not_found"
    }
    if ![id_not_found] and [id] != "" {
      mutate {
        replace => {
          "id_labels.key" => "id"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "id_labels"
        }
      }
    }

    mutate {
      convert => {
        "is_exe" => "string"
      }
      on_error => "is_exe_conversion_error"
    }

    mutate {
      replace => {
        "check_exe" => "%{is_exe}"
      }
      on_error => "is_exe_not_present"
    }

    if ![is_exe_not_present] {
      if [is_exe] == "true" {
        mutate {
          replace => {
            "pe_about.file.file_type" => "FILE_TYPE_PE_EXE"
          }
        }
      }
    }

    mutate {
      convert => {
        "is_64bit" => "string"
      }
      on_error => "is_64bit_conversion_error"
    }

    mutate {
      replace => {
        "is_64bit_labels.value" => "%{is_64bit}"
      }
      on_error => "is_64bit_not_found"
    }
    if ![is_64bit_not_found] and [is_64bit] != "" {
      mutate {
        replace => {
          "is_64bit_labels.key" => "is_64bit"
        }
      }
      mutate {
        merge => {
          "pe_about.labels" => "is_64bit_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "pe_about"
      }
      on_error => "pe_about_not_found"
    }

  }

  # ----------------------------------------------------------------------
  # Profinet

  else if [_path] == "profinet" {

    # UDM > About

    mutate {
      merge => {
        "profinet_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "block_version_labels.value" => "%{block_version}"
      }
      on_error => "block_version_not_found"
    }
    if ![block_version_not_found] and [block_version] != "" {
      mutate {
        replace => {
          "block_version_labels.key" => "block_version"
        }
      }
      mutate {
        merge => {
          "profinet_about.labels" => "block_version_labels"
        }
      }
    }

    mutate {
      replace => {
        "index_labels.value" => "%{index}"
      }
      on_error => "index_not_found"
    }
    if ![index_not_found] and [index] != "" {
      mutate {
        replace => {
          "index_labels.key" => "index"
        }
      }
      mutate {
        merge => {
          "profinet_about.labels" => "index_labels"
        }
      }
    }

    mutate {
      replace => {
        "operation_type_labels.value" => "%{operation_type}"
      }
      on_error => "operation_type_not_found"
    }
    if ![operation_type_not_found] and [operation_type] != "" {
      mutate {
        replace => {
          "operation_type_labels.key" => "operation_type"
        }
      }
      mutate {
        merge => {
          "profinet_about.labels" => "operation_type_labels"
        }
      }
    }

    mutate {
      convert => {
        "slot_number" => "string"
      }
      on_error => "slot_number_conversion_error"
    }

    mutate {
      replace => {
        "slot_number_labels.value" => "%{slot_number}"
      }
      on_error => "slot_number_not_found"
    }
    if ![slot_number_not_found] and [slot_number] != "" {
      mutate {
        replace => {
          "slot_number_labels.key" => "slot_number"
        }
      }
      mutate {
        merge => {
          "profinet_about.labels" => "slot_number_labels"
        }
      }
    }

    mutate {
      convert => {
        "subslot_number" => "string"
      }
      on_error => "subslot_number_conversion_error"
    }

    mutate {
      replace => {
        "subslot_number_labels.value" => "%{subslot_number}"
      }
      on_error => "subslot_number_not_found"
    }
    if ![subslot_number_not_found] and [subslot_number] != "" {
      mutate {
        replace => {
          "subslot_number_labels.key" => "subslot_number"
        }
      }
      mutate {
        merge => {
          "profinet_about.labels" => "subslot_number_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "profinet_about"
      }
      on_error => "profinet_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Profinet_dce_rpc

  else if [_path] == "profinet_dce_rpc" {

    # UDM > Network

    mutate {
      replace => {
        "token_network.application_protocol" => "DCERPC"
      }
    }

    # UDM > About

    mutate {
      merge => {
        "profinet_dce_rpc_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "version" => "string"
      }
      on_error => "version_conversion_error"
    }

    mutate {
      replace => {
        "version_labels.value" => "%{version}"
      }
      on_error => "version_not_found"
    }
    if ![version_not_found] and [version] != "" {
      mutate {
        replace => {
          "version_labels.key" => "version"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "version_labels"
        }
      }
    }

    mutate {
      convert => {
        "packet_type" => "string"
      }
      on_error => "packet_type_conversion_error"
    }

    mutate {
      replace => {
        "packet_type_labels.value" => "%{packet_type}"
      }
      on_error => "packet_type_not_found"
    }
    if ![packet_type_not_found] and [packet_type] != "" {
      mutate {
        replace => {
          "packet_type_labels.key" => "packet_type"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "packet_type_labels"
        }
      }
    }

    mutate {
      replace => {
        "object_uuid_labels.value" => "%{object_uuid}"
      }
      on_error => "object_uuid_not_found"
    }
    if ![object_uuid_not_found] and [object_uuid] != "" {
      mutate {
        replace => {
          "object_uuid_labels.key" => "object_uuid"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "object_uuid_labels"
        }
      }
    }

    mutate {
      replace => {
        "interface_uuid_labels.value" => "%{interface_uuid}"
      }
      on_error => "interface_uuid_not_found"
    }
    if ![interface_uuid_not_found] and [interface_uuid] != "" {
      mutate {
        replace => {
          "interface_uuid_labels.key" => "interface_uuid"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "interface_uuid_labels"
        }
      }
    }

    mutate {
      replace => {
        "activity_uuid_labels.value" => "%{activity_uuid}"
      }
      on_error => "activity_uuid_not_found"
    }
    if ![activity_uuid_not_found] and [activity_uuid] != "" {
      mutate {
        replace => {
          "activity_uuid_labels.key" => "activity_uuid"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "activity_uuid_labels"
        }
      }
    }

    mutate {
      convert => {
        "server_boot_time" => "string"
      }
      on_error => "server_boot_time_conversion_error"
    }

    mutate {
      replace => {
        "server_boot_time_labels.value" => "%{server_boot_time}"
      }
      on_error => "server_boot_time_not_found"
    }
    if ![server_boot_time_not_found] and [server_boot_time] != "" {
      mutate {
        replace => {
          "server_boot_time_labels.key" => "server_boot_time"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "server_boot_time_labels"
        }
      }
    }

    mutate {
      replace => {
        "operation_labels.value" => "%{operation}"
      }
      on_error => "operation_not_found"
    }
    if ![operation_not_found] and [operation] != "" {
      mutate {
        replace => {
          "operation_labels.key" => "operation"
        }
      }
      mutate {
        merge => {
          "profinet_dce_rpc_about.labels" => "operation_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "profinet_dce_rpc_about"
      }
      on_error => "profinet_dce_rpc_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Profinet_debug

  else if [_path] == "profinet_debug" {

    # UDM > About

    mutate {
      merge => {
        "profinet_debug_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "raw_data_labels.value" => "%{raw_data}"
      }
      on_error => "raw_data_not_found"
    }
    if ![raw_data_not_found] and [raw_data] != "" {
      mutate {
        replace => {
          "raw_data_labels.key" => "raw_data"
        }
      }
      mutate {
        merge => {
          "profinet_debug_about.labels" => "raw_data_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "profinet_debug_about"
      }
      on_error => "profinet_debug_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Radius

  else if [_path] == "radius" {

    # UDM > Extensions

    mutate {
      replace => {
        "extension_present" => "false"
      }
    }

    mutate {
      replace => {
        "token_extensions.auth.auth_details" => "%{result}"
      }
      on_error => "result_not_found"
    }

    if ![result_not_found] {
      mutate {
        replace => {
          "extension_present" => "true"
        }
      }
    }

    # UDM > Network

    mutate {
      convert => {
        "ttl" => "integer"
      }
      on_error => "ttl_conversion_error"
    }

    mutate {
      rename => {
        "ttl" => "token_network.session_duration.seconds"
      }
      on_error => "ttl_not_found"
    }

    # UDM > Intermediary

    mutate {
      replace => {
        "check_tunnel_client" => "%{tunnel_client}"
      }
      on_error => "tunnel_client_not_found"
    }

    mutate {
      convert => {
        "check_tunnel_client" => "ipaddress"
      }
      on_error => "tunnel_client_not_ip"
    }

    if ![tunnel_client_not_ip] {
      mutate {
        merge => {
          "radius_intermediary.ip" => "tunnel_client"
        }
        on_error => "tunnel_client_not_found"
      }
    }
    else {
      mutate {
        replace => {
          "radius_intermediary.domain.name" => "%{tunnel_client}"
        }
        on_error => "tunnel_client_not_found"
      }
    }

    mutate {
      replace => {
        "check_framed_addr" => "%{framed_addr}"
      }
      on_error => "framed_addr_not_found"
    }

    mutate {
      convert => {
        "check_framed_addr" => "ipaddress"
      }
      on_error => "framed_addr_not_ip"
    }

    if ![framed_addr_not_ip] {
      mutate {
        merge => {
          "nas_intermediary.ip" => "framed_addr"
        }
        on_error => "framed_addr_not_found"
      }

      mutate {
        merge => {
          "token_intermediary" => "nas_intermediary"
        }
        on_error => "nas_intermediary_not_found"
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "radius_intermediary"
      }
      on_error => "radius_intermediary_not_found"
    }

    # UDM > Principal
    grok {
      match => {
        "mac" => "%{MAC:temp_mac}"
      }
      on_error => "not_valid_mac"
    }
    if ![not_valid_mac] {
      mutate {
        merge => {
          "token_principal.mac" => "mac"
        }
      }
      mutate {
        replace => {
          "principal_present" => "true"
        }
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "token_target.user.userid" => "%{username}"
      }
      on_error => "username_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "radius_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "radius_about"
      }
      on_error => "radius_about_not_found"
    }

    # Check if required udm validation fields for USER_LOGIN exist, if not set as STATUS_UPDATE
    if [extension_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "USER_LOGIN"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Reporter

  else if [_path] == "reporter" {

    # UDM > Security Result
    mutate {
      replace => {
        "report_security_result.severity_details" => "%{level}"
      }
      on_error => "level_not_found"
    }

    mutate {
      uppercase => ["level"]
    }

    if ![level_not_found] and [level] in ["CRITICAL", "ERROR", "HIGH",
    "INFORMATIONAL", "LOW", "MEDIUM"] {
      mutate {
        replace => {
          "report_security_result.severity" => "%{level}"
        }
        on_error => "level_not_found"
      }
    }

    mutate {
      replace => {
        "report_security_result.description" => "%{message}"
      }
      on_error => "message_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "report_security_result"
      }
      on_error => "report_security_result_not_found"
    }

    # UDM > About

    mutate {
      replace => {
        "location_labels.value" => "%{location}"
      }
      on_error => "location_not_found"
    }
    if ![location_not_found] and [location] != "" {
      mutate {
        replace => {
          "location_labels.key" => "location"
        }
      }
      mutate {
        merge => {
          "report_about.labels" => "location_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "report_about"
      }
      on_error => "report_about_not_found"
    }

  }

  # ----------------------------------------------------------------------
  # Rfb

  else if [_path] == "rfb" {

    # UDM > Extensions
    mutate {
      replace => {
        "check_auth_methood" => "%{authentication_method}"
      }
      on_error => "authentication_method_not_found"
    }

    if ![authentication_method_not_found] {
      if [authentication_method] == "VNC" {
        mutate {
          replace => {
            "auth_mechanism" => "REMOTE_INTERACTIVE"
          }
        }
      }
      else {
        mutate {
          replace => {
            "auth_mechanism" => "MECHANISM_OTHER"
          }
        }
      }
      mutate {
        merge => {
          "token_extensions.auth.mechanism" => "auth_mechanism"
        }
      }
      mutate {
        replace => {
          "token_extensions.auth.auth_details" => "%{authentication_method}"
        }
      }
    }

    # UDM > Principal

    mutate {
      replace => {
        "client_major_version_labels.value" => "%{client_major_version}"
      }
      on_error => "client_major_version_not_found"
    }
    if ![client_major_version_not_found] and [client_major_version] != "" {
      mutate {
        replace => {
          "client_major_version_labels.key" => "client_major_version"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "client_major_version_labels"
        }
      }
    }

    mutate {
      replace => {
        "client_minor_version_labels.value" => "%{client_minor_version}"
      }
      on_error => "client_minor_version_not_found"
    }
    if ![client_minor_version_not_found] and [client_minor_version] != "" {
      mutate {
        replace => {
          "client_minor_version_labels.key" => "client_minor_version"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "client_minor_version_labels"
        }
      }
    }

    mutate {
      replace => {
        "desktop_name_labels.value" => "%{desktop_name}"
      }
      on_error => "desktop_name_not_found"
    }
    if ![desktop_name_not_found] and [desktop_name] != "" {
      mutate {
        replace => {
          "desktop_name_labels.key" => "desktop_name"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "desktop_name_labels"
        }
      }
    }

    mutate {
      convert => {
        "height" => "string"
      }
      on_error => "height_conversion_error"
    }

    mutate {
      replace => {
        "height_labels.value" => "%{height}"
      }
      on_error => "height_not_found"
    }
    if ![height_not_found] and [height] != "" {
      mutate {
        replace => {
          "height_labels.key" => "height"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "height_labels"
        }
      }
    }

    mutate {
      convert => {
        "width" => "string"
      }
      on_error => "width_conversion_error"
    }

    mutate {
      replace => {
        "width_labels.value" => "%{width}"
      }
      on_error => "width_not_found"
    }
    if ![width_not_found] and [width] != "" {
      mutate {
        replace => {
          "width_labels.key" => "width"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "width_labels"
        }
      }
    }

    # UDM > Security Result

    mutate {
      convert => {
        "auth" => "string"
      }
      on_error => "auth_conversion_error"
    }

    mutate {
      replace => {
        "check_auth" => "%{auth}"
      }
      on_error => "auth_not_found"
    }

    if ![auth_not_found] {
      if [auth] == "true" {
        mutate {
          replace => {
            "sec_action" => "ALLOW"
          }
        }
      }
      else {
        mutate {
          replace => {
            "sec_action" => "FAIL"
          }
        }
      }
      mutate {
        merge => {
          "rfb_security_result.action" => "sec_action"
        }
        on_error => "sec_action_not_found"
      }
    }

    mutate {
      merge => {
        "token_security_result" => "rfb_security_result"
      }
      on_error => "rfb_security_result_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "server_major_version_labels.value" => "%{server_major_version}"
      }
      on_error => "server_major_version_not_found"
    }
    if ![server_major_version_not_found] and [server_major_version] != "" {
      mutate {
        replace => {
          "server_major_version_labels.key" => "server_major_version"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "server_major_version_labels"
        }
      }
    }

    mutate {
      replace => {
        "server_minor_version_labels.value" => "%{server_minor_version}"
      }
      on_error => "server_minor_version_not_found"
    }
    if ![server_minor_version_not_found] and [server_minor_version] != "" {
      mutate {
        replace => {
          "server_minor_version_labels.key" => "server_minor_version"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "server_minor_version_labels"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "rfb_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "share_flag" => "string"
      }
      on_error => "share_flag_conversion_error"
    }

    mutate {
      replace => {
        "share_flag_labels.value" => "%{share_flag}"
      }
      on_error => "share_flag_not_found"
    }
    if ![share_flag_not_found] and [share_flag] != "" {
      mutate {
        replace => {
          "share_flag_labels.key" => "share_flag"
        }
      }
      mutate {
        merge => {
          "rfb_about.labels" => "share_flag_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "rfb_about"
      }
      on_error => "rfb_about_not_found"
    }


    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # S7comm

  else if [_path] == "s7comm" {

    # UDM > About

    mutate {
      merge => {
        "s7comm_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "rosctr_labels.value" => "%{rosctr}"
      }
      on_error => "rosctr_not_found"
    }
    if ![rosctr_not_found] and [rosctr] != "" {
      mutate {
        replace => {
          "rosctr_labels.key" => "rosctr"
        }
      }
      mutate {
        merge => {
          "s7comm_about.labels" => "rosctr_labels"
        }
      }
    }

    for par in parameter {

      mutate {
        replace => {
          "parameter_labels" => ""
        }
      }

      mutate {
        convert => {
          "par" => "string"
        }
        on_error => "parameter_conversion_error"
      }

      mutate {
        replace => {
          "parameter_labels.value" => "%{par}"
        }
        on_error => "parameter_not_found"
      }
      if ![parameter_not_found] and [par] != "" {
        mutate {
          replace => {
            "parameter_labels.key" => "parameter"
          }
        }
        mutate {
          merge => {
            "s7comm_about.labels" => "parameter_labels"
          }
        }
      }
    }

    mutate {
      convert => {
        "item_count" => "string"
      }
      on_error => "item_count_conversion_error"
    }

    mutate {
      replace => {
        "item_count_labels.value" => "%{item_count}"
      }
      on_error => "item_count_not_found"
    }
    if ![item_count_not_found] and [item_count] != "" {
      mutate {
        replace => {
          "item_count_labels.key" => "item_count"
        }
      }
      mutate {
        merge => {
          "s7comm_about.labels" => "item_count_labels"
        }
      }
    }

    for data in data_info {

      mutate {
        replace => {
          "data_info_labels" => ""
        }
      }

      mutate {
        convert => {
          "data_info" => "string"
        }
        on_error => "data_info_conversion_error"
      }

      mutate {
        replace => {
          "data_info_labels.value" => "%{data}"
        }
        on_error => "data_info_not_found"
      }
      if ![data_info_not_found] and [data] != "" {
        mutate {
          replace => {
            "data_info_labels.key" => "data_info"
          }
        }
        mutate {
          merge => {
            "s7comm_about.labels" => "data_info_labels"
          }
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "s7comm_about"
      }
      on_error => "s7comm_about_not_found"
    }

    # UDM > additional
    mutate {
      convert => {
        "error_class" => "string"
      }
      on_error => "error_class_conversion_error"
    }

    mutate {
      replace => {
        "error_class_label.value.string_value" => "%{error_class}"
      }
      on_error => "error_class_not_found"
    }

    if ![error_class_not_found] and
      [error_class_label][value][string_value] != "" {
      mutate {
        replace => {
          "error_class_label.key" => "error_class"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "error_class_label"
        }
      }
    }

    mutate {
      convert => {
        "error_code" => "string"
      }
      on_error => "error_code_conversion_error"
    }

    mutate {
      replace => {
        "error_code_label.value.string_value" => "%{error_code}"
      }
      on_error => "error_code_not_found"
    }

    if ![error_code_not_found] and
      [error_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "error_code_label.key" => "error_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "error_code_label"
        }
      }
    }

    mutate {
      convert => {
        "function_code" => "string"
      }
      on_error => "function_code_conversion_error"
    }

    mutate {
      replace => {
        "function_code_label.value.string_value" => "%{function_code}"
      }
      on_error => "function_code_not_found"
    }

    if ![function_code_not_found] and
      [function_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "function_code_label.key" => "function_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "function_code_label"
        }
      }
    }

    mutate {
      convert => {
        "function_name" => "string"
      }
      on_error => "function_name_conversion_error"
    }

    mutate {
      replace => {
        "function_name_label.value.string_value" => "%{function_name}"
      }
      on_error => "function_name_not_found"
    }

    if ![function_name_not_found] and
      [function_name_label][value][string_value] != "" {
      mutate {
        replace => {
          "function_name_label.key" => "function_name"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "function_name_label"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_label.value.string_value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }

    if ![is_orig_not_found] and
      [is_orig_label][value][string_value] != "" {
      mutate {
        replace => {
          "is_orig_label.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "is_orig_label"
        }
      }
    }

    mutate {
      convert => {
        "pdu_reference" => "string"
      }
      on_error => "pdu_reference_conversion_error"
    }

    mutate {
      replace => {
        "pdu_reference_label.value.string_value" => "%{pdu_reference}"
      }
      on_error => "pdu_reference_not_found"
    }

    if ![pdu_reference_not_found] and
      [pdu_reference_label][value][string_value] != "" {
      mutate {
        replace => {
          "pdu_reference_label.key" => "pdu_reference"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "pdu_reference_label"
        }
      }
    }

    mutate {
      convert => {
        "rosctr_code" => "string"
      }
      on_error => "rosctr_code_conversion_error"
    }

    mutate {
      replace => {
        "rosctr_code_label.value.string_value" => "%{rosctr_code}"
      }
      on_error => "rosctr_code_not_found"
    }

    if ![rosctr_code_not_found] and
      [rosctr_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "rosctr_code_label.key" => "rosctr_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "rosctr_code_label"
        }
      }
    }

    mutate {
      convert => {
        "rosctr_name" => "string"
      }
      on_error => "rosctr_name_conversion_error"
    }

    mutate {
      replace => {
        "rosctr_name_label.value.string_value" => "%{rosctr_name}"
      }
      on_error => "rosctr_name_not_found"
    }

    if ![rosctr_name_not_found] and
      [rosctr_name_label][value][string_value] != "" {
      mutate {
        replace => {
          "rosctr_name_label.key" => "rosctr_name"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "rosctr_name_label"
        }
      }
    }

    mutate {
      convert => {
        "subfunction_code" => "string"
      }
      on_error => "subfunction_code_conversion_error"
    }

    mutate {
      replace => {
        "subfunction_code_label.value.string_value" => "%{subfunction_code}"
      }
      on_error => "subfunction_code_not_found"
    }

    if ![subfunction_code_not_found] and
      [subfunction_code_label][value][string_value] != "" {
      mutate {
        replace => {
          "subfunction_code_label.key" => "subfunction_code"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "subfunction_code_label"
        }
      }
    }

    mutate {
      convert => {
        "subfunction_name" => "string"
      }
      on_error => "subfunction_name_conversion_error"
    }

    mutate {
      replace => {
        "subfunction_name_label.value.string_value" => "%{subfunction_name}"
      }
      on_error => "subfunction_name_not_found"
    }

    if ![subfunction_name_not_found] and
      [subfunction_name_label][value][string_value] != "" {
      mutate {
        replace => {
          "subfunction_name_label.key" => "subfunction_name"
        }
      }
      mutate {
        merge => {
          "token_additional.fields" => "subfunction_name_label"
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Smartpcap

  else if [_path] == "smartpcap" {

    # UDM > Metadata

    mutate {
      replace => {
        "token_metadata.product_name" => "smartpcap"
      }
    }

    mutate {
      replace => {
        "token_metadata.description" => "%{logstr}"
      }
      on_error => "logstr_not_found"
    }

    grok {
      match => {
        "logstr" =>
        "Lever Failure:\\s*uid:%{DATA:data_uid}\\s*lever:%{DATA:lever_level}\\s*rule:%{DATA:rule_id}\\s+%{GREEDYDATA:lever_msg}"
      }
      on_error => "logstr_not_match"
    }
    if ![logstr_not_match] {

      mutate {
        replace => {
          "uid_labels" => ""
        }
      }

      mutate {
        replace => {
          "uid_labels.value" => "%{data_uid}"
        }
        on_error => "uid_not_found"
      }

      if ![uid_not_found] and [data_uid] != "" {
        mutate {
          replace => {
            "uid_labels.key" => "uid"
          }
        }
        mutate {
          merge => {
            "smartpcap_about.labels" => "uid_labels"
          }
        }
      }

      mutate {
        merge => {
          "token_about" => "smartpcap_about"
        }
        on_error => "token_about_not_found"
      }

      mutate {
        replace => {
          "smartpcap_security_result.description" => "%{lever_msg}"
        }
        on_error => "lever_msg_not_found"
      }

      mutate {
        replace => {
          "smartpcap_security_result.rule_id" => "%{rule_id}"
        }
        on_error => "rule_id_not_found"
      }

      mutate {
        replace => {
          "lever_level_labels.value" => "%{lever_level}"
        }
        on_error => "lever_level_not_found"
      }

      if ![lever_level_not_found] and [lever_level] != "" {
        mutate {
          replace => {
            "lever_level_labels.key" => "lever_level"
          }
        }
        mutate {
          merge => {
            "smartpcap_security_result.detection_fields" => "lever_level_labels"
          }
        }
      }

      mutate {
        merge => {
          "token_security_result" => "smartpcap_security_result"
        }
        on_error => "smartpcap_security_result_not_found"
      }
    }

  }

  # ----------------------------------------------------------------------
  # Snmp

  else if [_path] == "snmp" {

    # UDM > Network

    mutate {
      convert => {
        "duration" => "integer"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      rename => {
        "duration" => "token_network.session_duration.seconds"
      }
      on_error => "duration_not_found"
    }

    mutate {
      replace => {
        "token_network.application_protocol_version" => "%{version}"
      }
      on_error => "version_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "snmp_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "community_labels.value" => "%{community}"
      }
      on_error => "community_not_found"
    }
    if ![community_not_found] and [community] != "" {
      mutate {
        replace => {
          "community_labels.key" => "community"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "community_labels"
        }
      }
    }

    mutate {
      convert => {
        "get_requests" => "string"
      }
      on_error => "get_requests_conversion_error"
    }

    mutate {
      replace => {
        "get_requests_labels.value" => "%{get_requests}"
      }
      on_error => "get_requests_not_found"
    }
    if ![get_requests_not_found] and [get_requests] != "" {
      mutate {
        replace => {
          "get_requests_labels.key" => "get_requests"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "get_requests_labels"
        }
      }
    }

    mutate {
      convert => {
        "get_bulk_requests" => "string"
      }
      on_error => "get_bulk_requests_conversion_error"
    }

    mutate {
      replace => {
        "get_bulk_requests_labels.value" => "%{get_bulk_requests}"
      }
      on_error => "get_bulk_requests_not_found"
    }
    if ![get_bulk_requests_not_found] and [get_bulk_requests] != "" {
      mutate {
        replace => {
          "get_bulk_requests_labels.key" => "get_bulk_requests"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "get_bulk_requests_labels"
        }
      }
    }

    mutate {
      convert => {
        "get_responses" => "string"
      }
      on_error => "get_responses_conversion_error"
    }

    mutate {
      replace => {
        "get_responses_labels.value" => "%{get_responses}"
      }
      on_error => "get_responses_not_found"
    }
    if ![get_responses_not_found] and [get_responses] != "" {
      mutate {
        replace => {
          "get_responses_labels.key" => "get_responses"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "get_responses_labels"
        }
      }
    }

    mutate {
      convert => {
        "set_requests" => "string"
      }
      on_error => "set_requests_conversion_error"
    }

    mutate {
      replace => {
        "set_requests_labels.value" => "%{set_requests}"
      }
      on_error => "set_requests_not_found"
    }
    if ![set_requests_not_found] and [set_requests] != "" {
      mutate {
        replace => {
          "set_requests_labels.key" => "set_requests"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "set_requests_labels"
        }
      }
    }

    mutate {
      replace => {
        "display_string_labels.value" => "%{display_string}"
      }
      on_error => "display_string_not_found"
    }
    if ![display_string_not_found] and [display_string] != ""
    and [display_string] != "-" {
      mutate {
        replace => {
          "display_string_labels.key" => "display_string"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "display_string_labels"
        }
      }
    }

    mutate {
      replace => {
        "up_since_labels.value" => "%{up_since}"
      }
      on_error => "up_since_not_found"
    }
    if ![up_since_not_found] and [up_since] != "" and [up_since] != "-" {
      mutate {
        replace => {
          "up_since_labels.key" => "up_since"
        }
      }
      mutate {
        merge => {
          "snmp_about.labels" => "up_since_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "snmp_about"
      }
      on_error => "snmp_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Socks

  else if [_path] == "socks" {

    # UDM > Extensions

    mutate {
      replace => {
        "token_extensions.auth.auth_details" => "%{password}"
      }
      on_error => "password_not_found"
    }

    # UDM > Intermediary

    mutate {
      replace => {
        "sock_intermediary.hostname" => "%{bound.name}"
      }
      on_error => "bound_name_not_found"
    }

    mutate {
      replace => {
        "check_bound_host" => "%{bound.host}"
      }
      on_error => "bound_host_not_found"
    }

    mutate {
      convert => {
        "check_bound_host" => "ipaddress"
      }
      on_error => "bound_host_not_ip"
    }
    if ![bound_host_not_ip] {
      mutate {
        merge => {
          "sock_intermediary.ip" => "bound.host"
        }
        on_error => "bound_host_not_found"
      }
    }

    mutate {
      convert => {
        "bound_p" => "integer"
      }
      on_error => "bound_p_not_valid_port"
    }
    if ![bound_p_not_valid_port] {
      mutate {
        rename => {
          "bound_p" => "sock_intermediary.port"
        }
        on_error => "bound_p_not_found"
      }
    }

    mutate {
      merge => {
        "token_intermediary" => "sock_intermediary"
      }
      on_error => "sock_intermediary_not_found"
    }

    # UDM > Principal

    mutate {
      replace => {
        "token_principal.user.userid" => "%{user}"
      }
      on_error => "user_not_found"
    }

    # UDM > Target

    mutate {
      replace => {
        "token_target.hostname" => "%{request.name}"
      }
      on_error => "request_name_not_found"
    }

    if ![request_name_not_found] {
      mutate {
        replace => {
          "target_present" => "true"
        }
      }
    }

    mutate {
      replace => {
        "check_request_host" => "%{request.host}"
      }
      on_error => "request_host_not_found"
    }

    mutate {
      convert => {
        "check_request_host" => "ipaddress"
      }
      on_error => "request_host_not_ip"
    }

    if ![request_host_not_ip] {
      mutate {
        merge => {
          "token_target.ip" => "request.host"
        }
        on_error => "request_host_not_found"
      }
      if ![request_host_not_found] {
        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
    }

    mutate {
      convert => {
        "request_p" => "string"
      }
      on_error => "request_p_conversion_error"
    }

    mutate {
      replace => {
        "request_p_labels.value" => "%{request_p}"
      }
      on_error => "request_p_not_found"
    }
    if ![request_p_not_found] and [request_p] != "" {
      mutate {
        replace => {
          "request_p_labels.key" => "request_p"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "request_p_labels"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "socks_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "status_labels.value" => "%{status}"
      }
      on_error => "status_not_found"
    }
    if ![status_not_found] and [status] != "" {
      mutate {
        replace => {
          "status_labels.key" => "status"
        }
      }
      mutate {
        merge => {
          "socks_about.labels" => "status_labels"
        }
      }
    }

    mutate {
      convert => {
        "version" => "string"
      }
      on_error => "version_conversion_error"
    }

    mutate {
      replace => {
        "version_labels.value" => "%{version}"
      }
      on_error => "version_not_found"
    }
    if ![version_not_found] and [version] != "" {
      mutate {
        replace => {
          "version_labels.key" => "version"
        }
      }
      mutate {
        merge => {
          "socks_about.labels" => "version_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "socks_about"
      }
      on_error => "socks_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Software

  else if [_path] == "software" {

    # UDM > Target

    mutate {
      replace => {
        "unparsed_version_labels.value" => "%{unparsed_version}"
      }
      on_error => "unparsed_version_not_found"
    }
    if ![unparsed_version_not_found] and [unparsed_version] != "" {
      mutate {
        replace => {
          "unparsed_version_labels.key" => "unparsed_version"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "unparsed_version_labels"
        }
      }
    }

    mutate {
      replace => {
        "version_addl_labels.value" => "%{version.addl}"
      }
      on_error => "version_addl_not_found"
    }
    if ![version_addl_not_found] and [version][addl] != "" {
      mutate {
        replace => {
          "version_addl_labels.key" => "version_addl"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "version_addl_labels"
        }
      }
    }

    mutate {
      convert => {
        "version.minor" => "string"
      }
      on_error => "version.minor_conversion_error"
    }

    mutate {
      replace => {
        "version_minor_labels.value" => "%{version.minor}"
      }
      on_error => "version_minor_not_found"
    }
    if ![version_minor_not_found] and [version][minor] != "" {
      mutate {
        replace => {
          "version_minor_labels.key" => "version_minor"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "version_minor_labels"
        }
      }
    }

    mutate {
      convert => {
        "version.minor2" => "string"
      }
      on_error => "version.minor2_conversion_error"
    }

    mutate {
      replace => {
        "version_minor2_labels.value" => "%{version.minor2}"
      }
      on_error => "version_minor2_not_found"
    }
    if ![version_minor2_not_found] and [version][minor2] != "" {
      mutate {
        replace => {
          "version_minor2_labels.key" => "version_minor2"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "version_minor2_labels"
        }
      }
    }

    mutate {
      convert => {
        "version.minor3" => "string"
      }
      on_error => "version.minor3_conversion_error"
    }

    mutate {
      replace => {
        "version_minor3_labels.value" => "%{version.minor3}"
      }
      on_error => "version_minor3_not_found"
    }
    if ![version_minor3_not_found] and [version][minor3] != "" {
      mutate {
        replace => {
          "version_minor3_labels.key" => "version_minor3"
        }
      }
      mutate {
        merge => {
          "token_target.asset.attribute.labels" => "version_minor3_labels"
        }
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "host_check" => "%{host}"
      }
      on_error => "host_not_found"
    }
    mutate {
      convert => {
        "host_check" => "ipaddress"
      }
      on_error => "host_not_valid_ip"
    }

    if ![host_not_valid_ip] {
      mutate {
        merge => {
          "token_target.asset.ip" => "host"
        }
        on_error => "host_not_found"
      }
    }

    mutate {
      convert => {
        "host_p" => "integer"
      }
      on_error => "host_p_not_vlaid"
    }

    if ![host_p_not_vlaid] {
      mutate {
        rename => {
          "host_p" => "token_target.port"
        }
      }
    }

    mutate {
      replace => {
        "token_software.description" => "%{software_type}"
      }
      on_error => "software_type_not_found"
    }

    mutate {
      replace => {
        "token_software.name" => "%{name}"
      }
      on_error => "name_not_found"
    }

    mutate {
      convert => {
        "version.major" => "string"
      }
      on_error => "version_major_conversion_error"
    }

    mutate {
      replace => {
        "token_software.version" => "%{version.major}"
      }
      on_error => "version_major_not_found"
    }

    mutate {
      merge => {
        "token_target.asset.software" => "token_software"
      }
      on_error => "token_software_not_found"
    }

  }

  # ----------------------------------------------------------------------
  # Specific_dns_tunnels

  else if [_path] == "specific_dns_tunnels" {

    # UDM > Network

    mutate {
      replace => {
        "token_network.application_protocol" => "DNS"
      }
    }

    mutate {
      convert => {
        "trans_id" => "uinteger"
      }
      on_error => "trans_id_conversion_error"
    }

    mutate {
      rename => {
        "trans_id" => "token_network.dns.id"
      }
    }

    mutate {
      convert => {
        "session_id" => "string"
      }
      on_error => "session_id_conversion_error"
    }

    mutate {
      replace => {
        "token_network.session_id" => "%{session_id}"
      }
      on_error => "session_id_not_found"
    }

    mutate {
      replace => {
        "question_check" => ""
      }
    }

    mutate {
      replace => {
        "question_check" => "%{query}"
      }
      on_error => "query_not_found"
    }

    if ![query_not_found] and [query] != "" {
      mutate {
        replace => {
          "token_question.name" => "%{query}"
        }
        on_error => "query_not_found"
      }
    }

    mutate {
      merge => {
        "token_network.dns.questions" => "token_question"
      }
      on_error => "token_question_not_found"
    }

    # UDM > Principal

    mutate {
      replace => {
        "token_principal.application" => "%{program}"
      }
      on_error => "program_not_found"
    }


    mutate {
      replace => {
        "check_dns_client" => "%{dns_client}"
      }
      on_error => "dns_client_not_found"
    }

    mutate {
      convert => {
        "check_dns_client" => "ipaddress"
      }
      on_error => "dns_client_not_valid_ip"
    }
    if ![dns_client_not_valid_ip] {
      mutate {
        merge => {
          "token_principal.ip" => "dns_client"
        }
        on_error => "dns_client_not_found"
      }
      if ![dns_client_not_found] {
        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "check_resolver" => "%{resolver}"
      }
      on_error => "resolver_not_found"
    }

    mutate {
      replace => {
        "check_resolver" => "ipaddress"
      }
      on_error => "check_resolver_not_valid_ip"
    }

    if ![check_resolver_not_valid_ip] {
      mutate {
        merge => {
          "token_target.ip" => "resolver"
        }
        on_error => "resolver_not_found"
      }
      if ![resolver_not_found] {
        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
    }


    # UDM > Security Result
    mutate {
      replace => {
        "detection_labels.value" => "%{detection}"
      }
      on_error => "detection_not_found"
    }
    if ![detection_not_found] and [detection] != "" {
      mutate {
        replace => {
          "detection_labels.key" => "detection"
        }
      }
      mutate {
        merge => {
          "dns_tunnel_security_result.detection_fields" => "detection_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_security_result" => "dns_tunnel_security_result"
      }
      on_error => "dns_tunnel_security_result_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "dns_tunnel_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "sods_id" => "string"
      }
      on_error => "sods_id_conversion_error"
    }

    mutate {
      replace => {
        "sods_id_labels.value" => "%{sods_id}"
      }
      on_error => "sods_id_not_found"
    }
    if ![sods_id_not_found] and [sods_id] != "" {
      mutate {
        replace => {
          "sods_id_labels.key" => "sods_id"
        }
      }
      mutate {
        merge => {
          "dns_tunnel_about.labels" => "sods_id_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "dns_tunnel_about"
      }
      on_error => "dns_tunnel_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_DNS exist, if not set as NETWORK_UNCATEGORIZED.
    # Occasional DNS logs include no question, we drop them as they have no pratical usage
    # UDM > Metadata > Event Type
    if [principal_present] == "true" and [question_check] != "" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_DNS"
        }
      }
    }
    else if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Stepping

  else if [_path] == "stepping" {

    # UDM > Principal

    mutate {
      replace => {
        "check_client1_h" => "%{client1_h}"
      }
      on_error => "client1_h_not_found"
    }

    mutate {
      convert => {
        "check_client1_h" => "ipaddress"
      }
      on_error => "check_client1_h_not_ip"
    }

    if ![check_client1_h_not_ip] {
      mutate {
        merge => {
          "token_principal.ip" => "client1_h"
        }
        on_error => "client1_h_not_found"
      }
      if ![client1_h_not_found] {
        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
    }

    mutate {
      convert => {
        "client1_p" => "integer"
      }
      on_error => "client1_p_not_valid_port"
    }

    if ![client1_p_not_valid_port] {
      mutate {
        rename => {
          "client1_p" => "token_principal.port"
        }
        on_error => "client1_p_not_found"
      }
    }

    mutate {
      replace => {
        "check_client2_h" => "%{client2_h}"
      }
      on_error => "client2_h_not_found"
    }

    mutate {
      convert => {
        "check_client2_h" => "ipaddress"
      }
      on_error => "check_client2_h_not_ip"
    }

    if ![check_client2_h_not_ip] {
      mutate {
        merge => {
          "token_principal.ip" => "client2_h"
        }
        on_error => "client2_h_not_found"
      }
      if ![client2_h_not_found] {
        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
    }

    mutate {
      convert => {
        "client2_p" => "string"
      }
      on_error => "client2_p_conversion_error"
    }

    mutate {
      replace => {
        "client2_p_labels.value" => "%{client2_p}"
      }
      on_error => "client2_p_not_found"
    }
    if ![client2_p_not_found] and [client2_p] != "" {
      mutate {
        replace => {
          "client2_p_labels.key" => "client2_p"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "client2_p_labels"
        }
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "check_server1_h" => "%{server1_h}"
      }
      on_error => "server1_h_not_found"
    }

    mutate {
      convert => {
        "check_server1_h" => "ipaddress"
      }
      on_error => "check_server1_h_not_ip"
    }

    if ![check_server1_h_not_ip] {
      mutate {
        merge => {
          "token_target.ip" => "server1_h"
        }
        on_error => "server1_h_not_found"
      }
      if ![server1_h_not_found] {
        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
    }

    mutate {
      convert => {
        "server1_p" => "integer"
      }
      on_error => "server1_p_not_valid_port"
    }

    if ![server1_p_not_valid_port] {
      mutate {
        rename => {
          "server1_p" => "token_target.port"
        }
        on_error => "server1_p_not_found"
      }
    }

    mutate {
      convert => {
        "server2_h" => "string"
      }
      on_error => "server2_h_conversion_error"
    }

    mutate {
      replace => {
        "server2_h_labels.value" => "%{server2_h}"
      }
      on_error => "server2_h_not_found"
    }
    if ![server2_h_not_found] and [server2_h] != "" {
      mutate {
        replace => {
          "server2_h_labels.key" => "server2_h"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "server2_h_labels"
        }
      }
    }

    mutate {
      convert => {
        "server2_p" => "string"
      }
      on_error => "server2_p_conversion_error"
    }

    mutate {
      replace => {
        "server2_p_labels.value" => "%{server2_p}"
      }
      on_error => "server2_p_not_found"
    }
    if ![server2_p_not_found] and [server2_p] != "" {
      mutate {
        replace => {
          "server2_p_labels.key" => "server2_p"
        }
      }
      mutate {
        merge => {
          "token_target.labels" => "server2_p_labels"
        }
      }
    }

    # UDM > About

    mutate {
      convert => {
        "direct" => "string"
      }
      on_error => "direct_conversion_error"
    }

    mutate {
      replace => {
        "direct_labels.value" => "%{direct}"
      }
      on_error => "direct_not_found"
    }
    if ![direct_not_found] and [direct] != "" {
      mutate {
        replace => {
          "direct_labels.key" => "direct"
        }
      }
      mutate {
        merge => {
          "stepping_about.labels" => "direct_labels"
        }
      }
    }

    mutate {
      convert => {
        "dt" => "string"
      }
      on_error => "dt_conversion_error"
    }

    mutate {
      replace => {
        "dt_labels.value" => "%{dt}"
      }
      on_error => "dt_not_found"
    }
    if ![dt_not_found] and [dt] != "" {
      mutate {
        replace => {
          "dt_labels.key" => "dt"
        }
      }
      mutate {
        merge => {
          "stepping_about.labels" => "dt_labels"
        }
      }
    }

    mutate {
      replace => {
        "uid1_labels.value" => "%{uid1}"
      }
      on_error => "uid1_not_found"
    }
    if ![uid1_not_found] and [uid1] != "" {
      mutate {
        replace => {
          "uid1_labels.key" => "uid1"
        }
      }
      mutate {
        merge => {
          "stepping_about.labels" => "uid1_labels"
        }
      }
    }

    mutate {
      replace => {
        "uid2_labels.value" => "%{uid2}"
      }
      on_error => "uid2_not_found"
    }
    if ![uid2_not_found] and [uid2] != "" {
      mutate {
        replace => {
          "uid2_labels.key" => "uid2"
        }
      }
      mutate {
        merge => {
          "stepping_about.labels" => "uid2_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "stepping_about"
      }
      on_error => "stepping_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Stun

  else if [_path] == "stun" {

    # UDM > Network

    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    mutate {
      replace => {
        "token_network.session_id" => "%{trans_id}"
      }
      on_error => "trans_id_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "stun_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      replace => {
        "class_labels.value" => "%{class}"
      }
      on_error => "class_not_found"
    }
    if ![class_not_found] and [class] != "" {
      mutate {
        replace => {
          "class_labels.key" => "class"
        }
      }
      mutate {
        merge => {
          "stun_about.labels" => "class_labels"
        }
      }
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_labels.value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }
    if ![is_orig_not_found] and [is_orig] != "" {
      mutate {
        replace => {
          "is_orig_labels.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "stun_about.labels" => "is_orig_labels"
        }
      }
    }

    mutate {
      replace => {
        "method_labels.value" => "%{method}"
      }
      on_error => "method_not_found"
    }
    if ![method_not_found] and [method] != "" {
      mutate {
        replace => {
          "method_labels.key" => "method"
        }
      }
      mutate {
        merge => {
          "stun_about.labels" => "method_labels"
        }
      }
    }

    for type_index,attr_type in attr_types {
      for val_index, attr_val in attr_vals {
        if [type_index] == [val_index] {
          mutate {
            replace => {
              "attr_types_labels" => ""
            }
          }
          mutate {
            replace => {
              "attr_types_labels.value" => "%{attr_val}"
              "attr_types_labels.key" => "%{attr_type}"
            }
            on_error => "attr_vals_not_found"
          }
          if ![attr_vals_not_found] and [attr_val] != "" and [attr_type] != "" {
            mutate {
              merge => {
                "stun_about.labels" => "attr_types_labels"
              }
            }
          }
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "stun_about"
      }
      on_error => "stun_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Stun_nat

  else if [_path] == "stun_nat" {

    # UDM > Network

    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    # UDM > Principal

    for lan_index, lan_val in lan_addrs {
      mutate {
        replace => {
          "check_lan_val" => "%{lan_val}"
        }
        on_error => "lan_val_not_found"
      }
      mutate {
        convert => {
          "check_lan_val" => "ipaddress"
        }
        on_error => "lan_val_not_valid_ip"
      }
      if ![lan_val_not_valid_ip] {
        mutate {
          merge => {
            "token_principal.ip" => "lan_val"
          }
          on_error => "lan_val_not_found"
        }
      }
    }

    for addr_index, wan_addr in wan_addrs {
      mutate {
        replace => {
          "check_wan_addr" => "%{wan_addr}"
        }
        on_error => "wan_addr_not_found"
      }

      mutate {
        convert => {
          "check_wan_addr" => "ipaddress"
        }
        on_error => "wan_addr_not_valid"
      }

      if ![wan_addr_not_valid] {
        mutate {
          merge => {
            "token_principal.nat_ip" => "wan_addr"
          }
          on_error => "wan_addr_not_found"
        }
      }

    }

    for port_index, wan_port in wan_ports {
      if [port_index] == 0 {
        mutate {
          convert => {
            "wan_port" => "integer"
          }
          on_error => "wan_port_not_valid_port"
        }
        if ![wan_port_not_valid_port] {
          mutate {
            rename => {
              "wan_port" => "token_principal.nat_port"
            }
          }
        }
      }
      else {
        mutate {
          replace => {
            "wan_port_labels" => ""
          }
        }
        mutate {
          convert => {
            "wan_port" => "string"
          }
          on_error => "wan_port_conversion_error"
        }
        mutate {
          replace => {
            "wan_port_labels.value" => "%{wan_port}"
          }
          on_error => "wan_port_not_found"
        }

        if ![wan_port_not_found] and [wan_port] != "" {
          mutate {
            replace => {
              "wan_port_labels.key" => "wan_port"
            }
          }
          mutate {
            merge => {
              "token_principal.labels" => "wan_port_labels"
            }
          }
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "stun_nat_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      convert => {
        "is_orig" => "string"
      }
      on_error => "is_orig_conversion_error"
    }

    mutate {
      replace => {
        "is_orig_labels.value" => "%{is_orig}"
      }
      on_error => "is_orig_not_found"
    }
    if ![is_orig_not_found] and [is_orig] != "" {
      mutate {
        replace => {
          "is_orig_labels.key" => "is_orig"
        }
      }
      mutate {
        merge => {
          "stun_nat_about.labels" => "is_orig_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "stun_nat_about"
      }
      on_error => "stun_nat_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Tds_sql_batch

  else if [_path] == "tds_sql_batch" {

    # UDM > Target

    mutate {
      replace => {
        "token_target.resource.resource_type" => "DATABASE"
      }
    }

    mutate {
      replace => {
        "header_type_labels.value" => "%{header_type}"
      }
      on_error => "header_type_not_found"
    }
    if ![header_type_not_found] and [header_type] != "" {
      mutate {
        replace => {
          "header_type_labels.key" => "header_type"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "header_type_labels"
        }
      }
    }

    mutate {
      replace => {
        "query_labels.value" => "%{query}"
      }
      on_error => "query_not_found"
    }
    if ![query_not_found] and [query] != "" {
      mutate {
        replace => {
          "query_labels.key" => "query"
        }
      }
      mutate {
        merge => {
          "token_target.resource.attribute.labels" => "query_labels"
        }
      }
    }

    # UDM > About

    mutate {
      merge => {
        "tds_sql_batch_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "tds_sql_batch_about"
      }
      on_error => "tds_sql_batch_about_not_found"
    }

    # Check if required udm validation fields for STATUS_UPDATE exist.

    if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Traceroute

  else if [_path] == "traceroute" {

    # UDM > Network

    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    # UDM > Principal
    mutate {
      replace => {
        "check_src" => "%{src}"
      }
      on_error => "src_not_found"
    }
    mutate {
      convert => {
        "check_src" => "ipaddress"
      }
      on_error => "src_not_valid_ip"
    }
    if ![src_not_valid_ip] {
      mutate {
        merge => {
          "token_principal.ip" => "src"
        }
        on_error => "src_not_found"
      }
      if ![src_not_found] {
        mutate {
          replace => {
            "principal_present" => "true"
          }
        }
      }
    }

    # UDM > Target
    mutate {
      replace => {
        "check_dst" => "%{dst}"
      }
      on_error => "dst_not_found"
    }
    mutate {
      convert => {
        "check_dst" => "ipaddress"
      }
      on_error => "dst_not_valid_ip"
    }
    if ![dst_not_valid_ip] {
      mutate {
        merge => {
          "token_target.ip" => "dst"
        }
        on_error => "dst_not_found"
      }
      if ![dst_not_found] {
        mutate {
          replace => {
            "target_present" => "true"
          }
        }
      }
    }

    # Check if required udm validation fields for NETWORK_UNCATEGORIZED exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_UNCATEGORIZED"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Tunnel

  else if [_path] == "tunnel" {

    # UDM > Intermediary

    mutate {
      replace => {
        "tunnel_type_labels.value" => "%{tunnel_type}"
      }
      on_error => "tunnel_type_not_found"
    }
    if ![tunnel_type_not_found] and [tunnel_type] != "" {
      mutate {
        replace => {
          "tunnel_type_labels.key" => "tunnel_type"
        }
      }
      mutate {
        merge => {
          "tunnel_intermediary.labels" => "tunnel_type_labels"
        }
      }
    }

    # UDM > Security Result

    mutate {
      replace => {
        "tunnel_security_result.description" =>
        "action %{action} on tunnel type %{tunnel_type}"
      }
      on_error => "action_not_found"
    }

    mutate {
      replace => {
        "tunnel_security_result.action_details" => "%{action}"
      }
      on_error => "action_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "tunnel_security_result"
      }
      on_error => "tunnel_security_result_not_found"
    }

    mutate {
      merge => {
        "token_intermediary" => "tunnel_intermediary"
      }
      on_error => "tunnel_intermediary_not_found"
    }

    # UDM > About

    mutate {
      merge => {
        "tunnel_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    mutate {
      merge => {
        "token_about" => "tunnel_about"
      }
      on_error => "tunnel_about_not_found"
    }


    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Unknown-smartpcap

  else if [_path] == "unknown-smartpcap" {

    # UDM > About
    mutate {
      replace => {
        "tid_labels.value" => "%{tid}"
      }
      on_error => "tid_not_found"
    }
    if ![tid_not_found] and [tid] != "" {
      mutate {
        replace => {
          "tid_labels.key" => "tid"
        }
      }
      mutate {
        merge => {
          "unknown_smartpcap_about.labels" => "tid_labels"
        }
      }
    }

    mutate {
      convert => {
        "pkts" => "string"
      }
      on_error => "pkts_conversion_error"
    }

    mutate {
      replace => {
        "pkts_labels.value" => "%{pkts}"
      }
      on_error => "pkts_not_found"
    }
    if ![pkts_not_found] and [pkts] != "" {
      mutate {
        replace => {
          "pkts_labels.key" => "pkts"
        }
      }
      mutate {
        merge => {
          "unknown_smartpcap_about.labels" => "pkts_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "unknown_smartpcap_about"
      }
      on_error => "unknown_smartpcap_about_not_found"
    }

    # UDM > Security Result
    mutate {
      replace => {
        "unknown_smartpcap_security_result.url_back_to_product" => "%{url}"
      }
      on_error => "url_not_found"
    }

    mutate {
      merge => {
        "token_security_result" => "unknown_smartpcap_security_result"
      }
      on_error => "unknown_smartpcap_security_result_not_found"
    }

    mutate {
      replace => {
        "token_metadata.product_name" => "Smartpcap"
      }
    }
  }

  # ----------------------------------------------------------------------
  # Vpn

  else if [_path] == "vpn" {

    # UDM > Network

    mutate {
      replace => {
        "protocol" => "%{proto}"
      }
      on_error => "proto_not_found"
    }
    if ![proto_not_found] {
      mutate {
        uppercase => ["proto"]
      }
      if [proto] in ["EIGRP","ESP", "GRE", "ICMP", "IGMP", "IP6IN4", "PIM",
      "TCP", "UDP", "VRRP"] {
        mutate {
          replace => {
            "token_network.ip_protocol" => "%{proto}"
          }
        }
      }
      else {
        mutate {
          replace => {
            "token_network.ip_protocol" => "UNKNOWN_IP_PROTOCOL"
          }
        }
      }
    }

    mutate {
      convert => {
        "resp_bytes" => "uinteger"
      }
      on_error => "resp_bytes_conversion_error"
    }

    mutate {
      rename => {
        "resp_bytes" => "token_network.received_bytes"
      }
    }

    mutate {
      convert => {
        "orig_bytes" => "uinteger"
      }
      on_error => "orig_bytes_conversion_error"
    }

    mutate {
      rename => {
        "orig_bytes" => "token_network.sent_bytes"
      }
    }

    mutate {
      convert => {
        "duration" => "integer"
      }
      on_error => "duration_conversion_error"
    }

    mutate {
      rename => {
        "duration" => "token_network.session_duration.seconds"
      }
    }

    mutate {
      replace => {
        "token_network.tls.client.certificate.issuer" => "%{issuer}"
      }
      on_error => "issuer_not_found"
    }

    mutate {
      replace => {
        "token_network.tls.client.certificate.subject" => "%{subject}"
      }
      on_error => "subject_not_found"
    }

    mutate {
      replace => {
        "checkja3" => "%{ja3}"
      }
      on_error => "ja3_check"
    }
    if ![ja3_check] and [ja3] =~ /^[0-9a-f]+$/ {
      mutate {
        replace => {
          "token_network.tls.client.ja3" => "%{ja3}"
        }
        on_error => "ja3_not_found"
      }
    }

    mutate {
      replace => {
        "token_network.tls.client.server_name" => "%{server_name}"
      }
      on_error => "server_name_not_found"
    }

    mutate {
      replace => {
        "checkja3s" => "%{ja3s}"
      }
      on_error => "ja3s_check"
    }
    if ![ja3s_check] and [ja3s] =~ /^[0-9a-f]+$/ {
      mutate {
        replace => {
          "token_network.tls.server.ja3s" => "%{ja3s}"
        }
        on_error => "ja3s_not_found"
      }
    }

    # UDM > Principal

    mutate {
      replace => {
        "client_info_labels.value" => "%{client_info}"
      }
      on_error => "client_info_not_found"
    }
    if ![client_info_not_found] and [client_info] != "" {
      mutate {
        replace => {
          "client_info_labels.key" => "client_info"
        }
      }
      mutate {
        merge => {
          "token_principal.labels" => "client_info_labels"
        }
      }
    }

    mutate {
      replace => {
        "token_principal.location.city" => "%{orig_city}"
      }
      on_error => "orig_city_not_found"
    }

    mutate {
      replace => {
        "token_principal.location.country_or_region" =>
        "%{orig_region} : %{orig_cc}"
      }
      on_error => "orig_region_orig_cc_not_found"
    }

    if [orig_region_orig_cc_not_found] {
      mutate {
        replace => {
          "token_principal.location.country_or_region" => "%{orig_region}"
        }
        on_error => "orig_region_not_found"
      }

      mutate {
        replace => {
          "token_principal.location.country_or_region" => "%{orig_cc}"
        }
        on_error => "orig_cc_not_found"
      }
    }

    # UDM > Target

    mutate {
      replace => {
        "token_target.application" => "%{service}"
      }
      on_error => "service_not_found"
    }

    mutate {
      replace => {
        "token_target.location.city" => "%{resp_city}"
      }
      on_error => "resp_city_not_found"
    }

    mutate {
      replace => {
        "token_target.location.country_or_region" =>
        "%{resp_region} : %{resp_cc}"
      }
      on_error => "resp_region_resp_cc_not_found"
    }

    if [resp_region_resp_cc_not_found] {
      mutate {
        replace => {
          "token_target.location.country_or_region" => "%{resp_cc}"
        }
        on_error => "resp_cc_not_found"
      }

      mutate {
        replace => {
          "token_target.location.country_or_region" => "%{resp_region}"
        }
        on_error => "resp_region_not_found"
      }
    }

    # UDM > About

    mutate {
      merge => {
        "vpn_about.labels" => "uid_labels"
      }
      on_error => "uid_labels_not_found"
    }

    for interence in inferences {

      mutate {
        replace => {
          "interence_labels" => ""
        }
      }

      mutate {
        convert => {
          "interence" => "string"
        }
        on_error => "inferences_conversion_error"
      }

      mutate {
        replace => {
          "interence_labels.value" => "%{interence}"
        }
        on_error => "interence_not_found"
      }
      if ![interence_not_found] and [interence] != "" {
        mutate {
          replace => {
            "interence_labels.key" => "inference"
          }
        }
        mutate {
          merge => {
            "vpn_about.labels" => "interence_labels"
          }
        }
      }
    }

    mutate {
      replace => {
        "vpn_type_labels.value" => "%{vpn_type}"
      }
      on_error => "vpn_type_not_found"
    }
    if ![vpn_type_not_found] and [vpn_type] != "" {
      mutate {
        replace => {
          "vpn_type_labels.key" => "vpn_type"
        }
      }
      mutate {
        merge => {
          "vpn_about.labels" => "vpn_type_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "vpn_about"
      }
      on_error => "vpn_about_not_found"
    }

    # Check if required udm validation fields for NETWORK_CONNECTION exist, if not set as STATUS_UPDATE
    if [principal_present] == "true" and [target_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "NETWORK_CONNECTION"
        }
      }
    }
    else if [principal_present] == "true" {
      mutate {
        replace => {
          "token_metadata.event_type" => "STATUS_UPDATE"
        }
      }
    }
  }

  # ----------------------------------------------------------------------
  # Suricata_stats

  else if[_path] == "suricata_stats" {

    # UDM > Metadata

    mutate {
      replace => {
        "token_metadata.product_name" => "Suricata"
      }
    }

    # UDM > About

    json {
      source => "raw_mgmt"
      on_error => "not_valid_json"
      array_function => "split_columns"
    }

    if ![not_valid_json] {

      date {
        match =>
        ["timestamp", "ISO8601", "RFC3339", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZZZ" ]
        on_error => "timestamp_not_found"
      }

      mutate {
        replace => {
          "raw_mgmt_labels.value" => "%{raw_mgmt}"
        }
        on_error => "raw_mgmt_not_found"
      }
      if ![raw_mgmt_not_found] and [raw_mgmt] != "" {
        mutate {
          replace => {
            "raw_mgmt_labels.key" => "raw_mgmt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "raw_mgmt_labels"
          }
        }
      }

      mutate {
        replace => {
          "event_type_labels.value" => "%{event_type}"
        }
        on_error => "event_type_not_found"
      }
      if ![event_type_not_found] and [event_type] != "" {
        mutate {
          replace => {
            "event_type_labels.key" => "event_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "event_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.uptime" => "string"
        }
        on_error => "stats_uptime_conversion_error"
      }

      mutate {
        replace => {
          "stats_uptime_labels.value" => "%{stats.uptime}"
        }
        on_error => "stats_uptime_not_found"
      }
      if ![stats_uptime_not_found] and [stats][uptime] != "" {
        mutate {
          replace => {
            "stats_uptime_labels.key" => "stats_uptime"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_uptime_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_total.pkts" => "string"
        }
        on_error => "stats_napa_total_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_total_pkts_labels.value" => "%{stats.napa_total.pkts}"
        }
        on_error => "stats_napa_total_pkts_not_found"
      }
      if ![stats_napa_total_pkts_not_found]
      and [stats][napa_total][pkts] != "" {
        mutate {
          replace => {
            "stats_napa_total_pkts_labels.key" => "stats_napa_total_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_napa_total_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_total.byte" => "string"
        }
        on_error => "stats_napa_total_byte_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_total_byte_labels.value" => "%{stats.napa_total.byte}"
        }
        on_error => "stats_napa_total_byte_not_found"
      }
      if ![stats_napa_total_byte_not_found]
      and [stats][napa_total][byte] != "" {
        mutate {
          replace => {
            "stats_napa_total_byte_labels.key" => "stats_napa_total_byte"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_napa_total_byte_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_total.overflow_drop_pkts" => "string"
        }
        on_error => "stats_napa_total_overflow_drop_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_total_overflow_drop_pkts_labels.value" =>
          "%{stats.napa_total.overflow_drop_pkts}"
        }
        on_error => "stats_napa_total_overflow_drop_pkts_not_found"
      }
      if ![stats_napa_total_overflow_drop_pkts_not_found]
      and [stats][napa_total][overflow_drop_pkts] != "" {
        mutate {
          replace => {
            "stats_napa_total_overflow_drop_pkts_labels.key" =>
            "stats_napa_total_overflow_drop_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_total_overflow_drop_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_total.overflow_drop_byte" => "string"
        }
        on_error => "stats_napa_total_overflow_drop_byte_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_total_overflow_drop_byte_labels.value" =>
           "%{stats.napa_total.overflow_drop_byte}"
        }
        on_error => "stats_napa_total_overflow_drop_byte_not_found"
      }
      if ![stats_napa_total_overflow_drop_byte_not_found]
      and [stats][napa_total][overflow_drop_byte] != "" {
        mutate {
          replace => {
            "stats_napa_total_overflow_drop_byte_labels.key" =>
            "stats_napa_total_overflow_drop_byte"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_total_overflow_drop_byte_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_dispatch_host.pkts" => "string"
        }
        on_error => "stats_napa_dispatch_host_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_dispatch_host_pkts_labels.value" =>
          "%{stats.napa_dispatch_host.pkts}"
        }
        on_error => "stats_napa_dispatch_host_pkts_not_found"
      }
      if ![stats_napa_dispatch_host_pkts_not_found]
      and [stats][napa_dispatch_host][pkts] != "" {
        mutate {
          replace => {
            "stats_napa_dispatch_host_pkts_labels.key" =>
            "stats_napa_dispatch_host_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_dispatch_host_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_dispatch_host.byte" => "string"
        }
        on_error => "stats_napa_dispatch_host_byte_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_dispatch_host_byte_labels.value" =>
          "%{stats.napa_dispatch_host.byte}"
        }
        on_error => "stats_napa_dispatch_host_byte_not_found"
      }
      if ![stats_napa_dispatch_host_byte_not_found]
      and [stats][napa_dispatch_host][byte] != "" {
        mutate {
          replace => {
            "stats_napa_dispatch_host_byte_labels.key" =>
            "stats_napa_dispatch_host_byte"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_dispatch_host_byte_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_dispatch_drop.pkts" => "string"
        }
        on_error => "stats_napa_dispatch_drop_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_dispatch_drop_pkts_labels.value" =>
          "%{stats.napa_dispatch_drop.pkts}"
        }
        on_error => "stats_napa_dispatch_drop_pkts_not_found"
      }
      if ![stats_napa_dispatch_drop_pkts_not_found]
      and [stats][napa_dispatch_drop][pkts] != "" {
        mutate {
          replace => {
            "stats_napa_dispatch_drop_pkts_labels.key" =>
            "stats_napa_dispatch_drop_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_dispatch_drop_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.napa_dispatch_drop.byte" => "string"
        }
        on_error => "stats_napa_dispatch_drop_byte_conversion_error"
      }

      mutate {
        replace => {
          "stats_napa_dispatch_drop_byte_labels.value" =>
          "%{stats.napa_dispatch_drop.byte}"
        }
        on_error => "stats_napa_dispatch_drop_byte_not_found"
      }
      if ![stats_napa_dispatch_drop_byte_not_found]
      and [stats][napa_dispatch_drop][byte] != "" {
        mutate {
          replace => {
            "stats_napa_dispatch_drop_byte_labels.key" =>
            "stats_napa_dispatch_drop_byte"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_napa_dispatch_drop_byte_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.pkts" => "string"
        }
        on_error => "stats_decoder_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_pkts_labels.value" => "%{stats.decoder.pkts}"
        }
        on_error => "stats_decoder_pkts_not_found"
      }
      if ![stats_decoder_pkts_not_found] and [stats][decoder][pkts] != "" {
        mutate {
          replace => {
            "stats_decoder_pkts_labels.key" => "stats_decoder_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.bytes" => "string"
        }
        on_error => "stats_decoder_bytes_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_bytes_labels.value" => "%{stats.decoder.bytes}"
        }
        on_error => "stats_decoder_bytes_not_found"
      }
      if ![stats_decoder_bytes_not_found] and [stats][decoder][bytes] != "" {
        mutate {
          replace => {
            "stats_decoder_bytes_labels.key" => "stats_decoder_bytes"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_bytes_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.invalid" => "string"
        }
        on_error => "stats_decoder_invalid_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_invalid_labels.value" => "%{stats.decoder.invalid}"
        }
        on_error => "stats_decoder_invalid_not_found"
      }
      if ![stats_decoder_invalid_not_found]
      and [stats][decoder][invalid] != "" {
        mutate {
          replace => {
            "stats_decoder_invalid_labels.key" => "stats_decoder_invalid"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_invalid_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ipv4" => "string"
        }
        on_error => "stats_decoder_ipv4_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ipv4_labels.value" => "%{stats.decoder.ipv4}"
        }
        on_error => "stats_decoder_ipv4_not_found"
      }
      if ![stats_decoder_ipv4_not_found] and [stats][decoder][ipv4] != "" {
        mutate {
          replace => {
            "stats_decoder_ipv4_labels.key" => "stats_decoder_ipv4"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ipv4_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ipv6" => "string"
        }
        on_error => "stats_decoder_ipv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ipv6_labels.value" => "%{stats.decoder.ipv6}"
        }
        on_error => "stats_decoder_ipv6_not_found"
      }
      if ![stats_decoder_ipv6_not_found] and [stats][decoder][ipv6] != "" {
        mutate {
          replace => {
            "stats_decoder_ipv6_labels.key" => "stats_decoder_ipv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ipv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ethernet" => "string"
        }
        on_error => "stats_decoder_ethernet_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ethernet_labels.value" => "%{stats.decoder.ethernet}"
        }
        on_error => "stats_decoder_ethernet_not_found"
      }
      if ![stats_decoder_ethernet_not_found]
      and [stats][decoder][ethernet] != "" {
        mutate {
          replace => {
            "stats_decoder_ethernet_labels.key" => "stats_decoder_ethernet"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ethernet_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.chdlc" => "string"
        }
        on_error => "stats_decoder_chdlc_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_chdlc_labels.value" => "%{stats.decoder.chdlc}"
        }
        on_error => "stats_decoder_chdlc_not_found"
      }
      if ![stats_decoder_chdlc_not_found] and [stats][decoder][chdlc] != "" {
        mutate {
          replace => {
            "stats_decoder_chdlc_labels.key" => "stats_decoder_chdlc"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_chdlc_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.raw" => "string"
        }
        on_error => "stats_decoder_raw_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_raw_labels.value" => "%{stats.decoder.raw}"
        }
        on_error => "stats_decoder_raw_not_found"
      }
      if ![stats_decoder_raw_not_found] and [stats][decoder][raw] != "" {
        mutate {
          replace => {
            "stats_decoder_raw_labels.key" => "stats_decoder_raw"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_raw_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.null" => "string"
        }
        on_error => "stats_decoder_null_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_null_labels.value" => "%{stats.decoder.null}"
        }
        on_error => "stats_decoder_null_not_found"
      }
      if ![stats_decoder_null_not_found] and [stats][decoder][null] != "" {
        mutate {
          replace => {
            "stats_decoder_null_labels.key" => "stats_decoder_null"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_null_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.sll" => "string"
        }
        on_error => "stats_decoder_sll_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_sll_labels.value" => "%{stats.decoder.sll}"
        }
        on_error => "stats_decoder_sll_not_found"
      }
      if ![stats_decoder_sll_not_found] and [stats][decoder][sll] != "" {
        mutate {
          replace => {
            "stats_decoder_sll_labels.key" => "stats_decoder_sll"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_sll_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.tcp" => "string"
        }
        on_error => "stats_decoder_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_tcp_labels.value" => "%{stats.decoder.tcp}"
        }
        on_error => "stats_decoder_tcp_not_found"
      }
      if ![stats_decoder_tcp_not_found] and [stats][decoder][tcp] != "" {
        mutate {
          replace => {
            "stats_decoder_tcp_labels.key" => "stats_decoder_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.udp" => "string"
        }
        on_error => "stats_decoder_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_udp_labels.value" => "%{stats.decoder.udp}"
        }
        on_error => "stats_decoder_udp_not_found"
      }
      if ![stats_decoder_udp_not_found] and [stats][decoder][udp] != "" {
        mutate {
          replace => {
            "stats_decoder_udp_labels.key" => "stats_decoder_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.sctp" => "string"
        }
        on_error => "stats_decoder_sctp_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_sctp_labels.value" => "%{stats.decoder.sctp}"
        }
        on_error => "stats_decoder_sctp_not_found"
      }
      if ![stats_decoder_sctp_not_found] and [stats][decoder][sctp] != "" {
        mutate {
          replace => {
            "stats_decoder_sctp_labels.key" => "stats_decoder_sctp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_sctp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.icmpv4" => "string"
        }
        on_error => "stats_decoder_icmpv4_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_icmpv4_labels.value" => "%{stats.decoder.icmpv4}"
        }
        on_error => "stats_decoder_icmpv4_not_found"
      }
      if ![stats_decoder_icmpv4_not_found] and [stats][decoder][icmpv4] != "" {
        mutate {
          replace => {
            "stats_decoder_icmpv4_labels.key" => "stats_decoder_icmpv4"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_icmpv4_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.icmpv6" => "string"
        }
        on_error => "stats_decoder_icmpv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_icmpv6_labels.value" => "%{stats.decoder.icmpv6}"
        }
        on_error => "stats_decoder_icmpv6_not_found"
      }
      if ![stats_decoder_icmpv6_not_found] and [stats][decoder][icmpv6] != "" {
        mutate {
          replace => {
            "stats_decoder_icmpv6_labels.key" => "stats_decoder_icmpv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_icmpv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ppp" => "string"
        }
        on_error => "stats_decoder_ppp_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ppp_labels.value" => "%{stats.decoder.ppp}"
        }
        on_error => "stats_decoder_ppp_not_found"
      }
      if ![stats_decoder_ppp_not_found] and [stats][decoder][ppp] != "" {
        mutate {
          replace => {
            "stats_decoder_ppp_labels.key" => "stats_decoder_ppp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ppp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.pppoe" => "string"
        }
        on_error => "stats_decoder_pppoe_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_pppoe_labels.value" => "%{stats.decoder.pppoe}"
        }
        on_error => "stats_decoder_pppoe_not_found"
      }
      if ![stats_decoder_pppoe_not_found] and [stats][decoder][pppoe] != "" {
        mutate {
          replace => {
            "stats_decoder_pppoe_labels.key" => "stats_decoder_pppoe"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_pppoe_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.geneve" => "string"
        }
        on_error => "stats_decoder_geneve_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_geneve_labels.value" => "%{stats.decoder.geneve}"
        }
        on_error => "stats_decoder_geneve_not_found"
      }
      if ![stats_decoder_geneve_not_found] and [stats][decoder][geneve] != "" {
        mutate {
          replace => {
            "stats_decoder_geneve_labels.key" => "stats_decoder_geneve"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_geneve_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.gre" => "string"
        }
        on_error => "stats_decoder_gre_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_gre_labels.value" => "%{stats.decoder.gre}"
        }
        on_error => "stats_decoder_gre_not_found"
      }
      if ![stats_decoder_gre_not_found] and [stats][decoder][gre] != "" {
        mutate {
          replace => {
            "stats_decoder_gre_labels.key" => "stats_decoder_gre"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_gre_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.vlan" => "string"
        }
        on_error => "stats_decoder_vlan_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_vlan_labels.value" => "%{stats.decoder.vlan}"
        }
        on_error => "stats_decoder_vlan_not_found"
      }
      if ![stats_decoder_vlan_not_found] and [stats][decoder][vlan] != "" {
        mutate {
          replace => {
            "stats_decoder_vlan_labels.key" => "stats_decoder_vlan"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_vlan_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.vlan_qinq" => "string"
        }
        on_error => "stats_decoder_vlan_qinq_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_vlan_qinq_labels.value" => "%{stats.decoder.vlan_qinq}"
        }
        on_error => "stats_decoder_vlan_qinq_not_found"
      }
      if ![stats_decoder_vlan_qinq_not_found]
      and [stats][decoder][vlan_qinq] != "" {
        mutate {
          replace => {
            "stats_decoder_vlan_qinq_labels.key" => "stats_decoder_vlan_qinq"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_vlan_qinq_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.vxlan" => "string"
        }
        on_error => "stats_decoder_vxlan_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_vxlan_labels.value" => "%{stats.decoder.vxlan}"
        }
        on_error => "stats_decoder_vxlan_not_found"
      }
      if ![stats_decoder_vxlan_not_found] and [stats][decoder][vxlan] != "" {
        mutate {
          replace => {
            "stats_decoder_vxlan_labels.key" => "stats_decoder_vxlan"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_vxlan_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.vntag" => "string"
        }
        on_error => "stats_decoder_vntag_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_vntag_labels.value" => "%{stats.decoder.vntag}"
        }
        on_error => "stats_decoder_vntag_not_found"
      }
      if ![stats_decoder_vntag_not_found] and [stats][decoder][vntag] != "" {
        mutate {
          replace => {
            "stats_decoder_vntag_labels.key" => "stats_decoder_vntag"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_vntag_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ieee8021ah" => "string"
        }
        on_error => "stats_decoder_ieee8021ah_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ieee8021ah_labels.value" => "%{stats.decoder.ieee8021ah}"
        }
        on_error => "stats_decoder_ieee8021ah_not_found"
      }
      if ![stats_decoder_ieee8021ah_not_found]
      and [stats][decoder][ieee8021ah] != "" {
        mutate {
          replace => {
            "stats_decoder_ieee8021ah_labels.key" => "stats_decoder_ieee8021ah"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ieee8021ah_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.teredo" => "string"
        }
        on_error => "stats_decoder_teredo_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_teredo_labels.value" => "%{stats.decoder.teredo}"
        }
        on_error => "stats_decoder_teredo_not_found"
      }
      if ![stats_decoder_teredo_not_found] and [stats][decoder][teredo] != "" {
        mutate {
          replace => {
            "stats_decoder_teredo_labels.key" => "stats_decoder_teredo"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_teredo_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ipv4_in_ipv6" => "string"
        }
        on_error => "stats_decoder_ipv4_in_ipv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ipv4_in_ipv6_labels.value" =>
          "%{stats.decoder.ipv4_in_ipv6}"
        }
        on_error => "stats_decoder_ipv4_in_ipv6_not_found"
      }
      if ![stats_decoder_ipv4_in_ipv6_not_found]
      and [stats][decoder][ipv4_in_ipv6] != "" {
        mutate {
          replace => {
            "stats_decoder_ipv4_in_ipv6_labels.key" =>
            "stats_decoder_ipv4_in_ipv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ipv4_in_ipv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.ipv6_in_ipv6" => "string"
        }
        on_error => "stats_decoder_ipv6_in_ipv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_ipv6_in_ipv6_labels.value" =>
          "%{stats.decoder.ipv6_in_ipv6}"
        }
        on_error => "stats_decoder_ipv6_in_ipv6_not_found"
      }
      if ![stats_decoder_ipv6_in_ipv6_not_found]
      and [stats][decoder][ipv6_in_ipv6] != "" {
        mutate {
          replace => {
            "stats_decoder_ipv6_in_ipv6_labels.key" =>
            "stats_decoder_ipv6_in_ipv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_ipv6_in_ipv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.mpls" => "string"
        }
        on_error => "stats_decoder_mpls_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_mpls_labels.value" => "%{stats.decoder.mpls}"
        }
        on_error => "stats_decoder_mpls_not_found"
      }
      if ![stats_decoder_mpls_not_found] and [stats][decoder][mpls] != "" {
        mutate {
          replace => {
            "stats_decoder_mpls_labels.key" => "stats_decoder_mpls"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_mpls_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.avg_pkt_size" => "string"
        }
        on_error => "stats_decoder_avg_pkt_size_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_avg_pkt_size_labels.value" =>
          "%{stats.decoder.avg_pkt_size}"
        }
        on_error => "stats_decoder_avg_pkt_size_not_found"
      }
      if ![stats_decoder_avg_pkt_size_not_found]
      and [stats][decoder][avg_pkt_size] != "" {
        mutate {
          replace => {
            "stats_decoder_avg_pkt_size_labels.key" =>
            "stats_decoder_avg_pkt_size"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_avg_pkt_size_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.max_pkt_size" => "string"
        }
        on_error => "stats_decoder_max_pkt_size_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_max_pkt_size_labels.value" =>
          "%{stats.decoder.max_pkt_size}"
        }
        on_error => "stats_decoder_max_pkt_size_not_found"
      }
      if ![stats_decoder_max_pkt_size_not_found]
      and [stats][decoder][max_pkt_size] != "" {
        mutate {
          replace => {
            "stats_decoder_max_pkt_size_labels.key" =>
            "stats_decoder_max_pkt_size"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_max_pkt_size_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.max_mac_addrs_src" => "string"
        }
        on_error => "stats_decoder_max_mac_addrs_src_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_max_mac_addrs_src_labels.value" =>
          "%{stats.decoder.max_mac_addrs_src}"
        }
        on_error => "stats_decoder_max_mac_addrs_src_not_found"
      }
      if ![stats_decoder_max_mac_addrs_src_not_found]
      and [stats][decoder][max_mac_addrs_src] != "" {
        mutate {
          replace => {
            "stats_decoder_max_mac_addrs_src_labels.key" =>
            "stats_decoder_max_mac_addrs_src"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_max_mac_addrs_src_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.max_mac_addrs_dst" => "string"
        }
        on_error => "stats_decoder_max_mac_addrs_dst_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_max_mac_addrs_dst_labels.value" =>
          "%{stats.decoder.max_mac_addrs_dst}"
        }
        on_error => "stats_decoder_max_mac_addrs_dst_not_found"
      }
      if ![stats_decoder_max_mac_addrs_dst_not_found]
      and [stats][decoder][max_mac_addrs_dst] != "" {
        mutate {
          replace => {
            "stats_decoder_max_mac_addrs_dst_labels.key" =>
            "stats_decoder_max_mac_addrs_dst"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_max_mac_addrs_dst_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.erspan" => "string"
        }
        on_error => "stats_decoder_erspan_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_erspan_labels.value" => "%{stats.decoder.erspan}"
        }
        on_error => "stats_decoder_erspan_not_found"
      }
      if ![stats_decoder_erspan_not_found] and [stats][decoder][erspan] != "" {
        mutate {
          replace => {
            "stats_decoder_erspan_labels.key" => "stats_decoder_erspan"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_decoder_erspan_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ipv4_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ipv4.pkt_too_small}"
        }
        on_error => "stats_decoder_event_ipv4_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ipv4_pkt_too_small_not_found]
      and [stats][decoder][event][ipv4][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_pkt_too_small_labels.key" =>
            "stats_decoder_event_ipv4_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.hlen_too_small" => "string"
        }
        on_error => "stats_decoder_event_ipv4_hlen_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_hlen_too_small_labels.value" =>
          "%{stats.decoder.event.ipv4.hlen_too_small}"
        }
        on_error => "stats_decoder_event_ipv4_hlen_too_small_not_found"
      }
      if ![stats_decoder_event_ipv4_hlen_too_small_not_found]
      and [stats][decoder][event][ipv4][hlen_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_hlen_too_small_labels.key" =>
            "stats_decoder_event_ipv4_hlen_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_hlen_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.iplen_smaller_than_hlen" => "string"
        }
        on_error => "ipv4_iplen_smaller_than_hlen_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_iplen_smaller_than_hlen_labels.value" =>
          "%{stats.decoder.event.ipv4.iplen_smaller_than_hlen}"
        }
        on_error => "stats_decoder_event_ipv4_iplen_smaller_than_hlen_not_found"
      }
      if ![stats_decoder_event_ipv4_iplen_smaller_than_hlen_not_found]
      and [stats][decoder][event][ipv4][iplen_smaller_than_hlen] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_iplen_smaller_than_hlen_labels.key" =>
            "stats_decoder_event_ipv4_iplen_smaller_than_hlen"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_iplen_smaller_than_hlen_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.trunc_pkt" => "string"
        }
        on_error => "stats_decoder_event_ipv4_trunc_pkt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_trunc_pkt_labels.value" =>
          "%{stats.decoder.event.ipv4.trunc_pkt}"
        }
        on_error => "stats_decoder_event_ipv4_trunc_pkt_not_found"
      }
      if ![stats_decoder_event_ipv4_trunc_pkt_not_found]
      and [stats][decoder][event][ipv4][trunc_pkt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_trunc_pkt_labels.key" =>
            "stats_decoder_event_ipv4_trunc_pkt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_trunc_pkt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_invalid" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_invalid_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_invalid_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_invalid}"
        }
        on_error => "stats_decoder_event_ipv4_opt_invalid_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_invalid_not_found]
      and [stats][decoder][event][ipv4][opt_invalid] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_invalid_labels.key" =>
            "stats_decoder_event_ipv4_opt_invalid"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_invalid_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_invalid_len" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_invalid_len_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_invalid_len_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_invalid_len}"
        }
        on_error => "stats_decoder_event_ipv4_opt_invalid_len_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_invalid_len_not_found]
      and [stats][decoder][event][ipv4][opt_invalid_len] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_invalid_len_labels.key" =>
            "stats_decoder_event_ipv4_opt_invalid_len"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_invalid_len_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_malformed" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_malformed_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_malformed_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_malformed}"
        }
        on_error => "stats_decoder_event_ipv4_opt_malformed_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_malformed_not_found]
      and [stats][decoder][event][ipv4][opt_malformed] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_malformed_labels.key" =>
            "stats_decoder_event_ipv4_opt_malformed"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_malformed_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_pad_required" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_pad_required_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_pad_required_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_pad_required}"
        }
        on_error => "stats_decoder_event_ipv4_opt_pad_required_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_pad_required_not_found]
      and [stats][decoder][event][ipv4][opt_pad_required] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_pad_required_labels.key" =>
            "stats_decoder_event_ipv4_opt_pad_required"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_pad_required_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_eol_required" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_eol_required_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_eol_required_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_eol_required}"
        }
        on_error => "stats_decoder_event_ipv4_opt_eol_required_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_eol_required_not_found]
      and [stats][decoder][event][ipv4][opt_eol_required] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_eol_required_labels.key" =>
            "stats_decoder_event_ipv4_opt_eol_required"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_eol_required_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_duplicate" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_duplicate_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_duplicate_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_duplicate}"
        }
        on_error => "stats_decoder_event_ipv4_opt_duplicate_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_duplicate_not_found]
      and [stats][decoder][event][ipv4][opt_duplicate] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_duplicate_labels.key" =>
            "stats_decoder_event_ipv4_opt_duplicate"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_duplicate_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.opt_unknown" => "string"
        }
        on_error => "stats_decoder_event_ipv4_opt_unknown_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_opt_unknown_labels.value" =>
          "%{stats.decoder.event.ipv4.opt_unknown}"
        }
        on_error => "stats_decoder_event_ipv4_opt_unknown_not_found"
      }
      if ![stats_decoder_event_ipv4_opt_unknown_not_found]
      and [stats][decoder][event][ipv4][opt_unknown] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_opt_unknown_labels.key" =>
            "stats_decoder_event_ipv4_opt_unknown"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_opt_unknown_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.wrong_ip_version" => "string"
        }
        on_error => "stats_decoder_event_ipv4_wrong_ip_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_wrong_ip_version_labels.value" =>
          "%{stats.decoder.event.ipv4.wrong_ip_version}"
        }
        on_error => "stats_decoder_event_ipv4_wrong_ip_version_not_found"
      }
      if ![stats_decoder_event_ipv4_wrong_ip_version_not_found]
      and [stats][decoder][event][ipv4][wrong_ip_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_wrong_ip_version_labels.key" =>
            "stats_decoder_event_ipv4_wrong_ip_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_wrong_ip_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.icmpv6" => "string"
        }
        on_error => "stats_decoder_event_ipv4_icmpv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_icmpv6_labels.value" =>
          "%{stats.decoder.event.ipv4.icmpv6}"
        }
        on_error => "stats_decoder_event_ipv4_icmpv6_not_found"
      }
      if ![stats_decoder_event_ipv4_icmpv6_not_found]
      and [stats][decoder][event][ipv4][icmpv6] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_icmpv6_labels.key" =>
            "stats_decoder_event_ipv4_icmpv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_icmpv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.frag_pkt_too_large" => "string"
        }
        on_error => "frag_pkt_too_large_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_frag_pkt_too_large_labels.value" =>
          "%{stats.decoder.event.ipv4.frag_pkt_too_large}"
        }
        on_error => "stats_decoder_event_ipv4_frag_pkt_too_large_not_found"
      }
      if ![stats_decoder_event_ipv4_frag_pkt_too_large_not_found]
      and [stats][decoder][event][ipv4][frag_pkt_too_large] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_frag_pkt_too_large_labels.key" =>
            "stats_decoder_event_ipv4_frag_pkt_too_large"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_frag_pkt_too_large_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.frag_overlap" => "string"
        }
        on_error => "stats_decoder_event_ipv4_frag_overlap_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_frag_overlap_labels.value" =>
          "%{stats.decoder.event.ipv4.frag_overlap}"
        }
        on_error => "stats_decoder_event_ipv4_frag_overlap_not_found"
      }
      if ![stats_decoder_event_ipv4_frag_overlap_not_found]
      and [stats][decoder][event][ipv4][frag_overlap] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_frag_overlap_labels.key" =>
            "stats_decoder_event_ipv4_frag_overlap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_frag_overlap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv4.frag_ignored" => "string"
        }
        on_error => "stats_decoder_event_ipv4_frag_ignored_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv4_frag_ignored_labels.value" =>
          "%{stats.decoder.event.ipv4.frag_ignored}"
        }
        on_error => "stats_decoder_event_ipv4_frag_ignored_not_found"
      }
      if ![stats_decoder_event_ipv4_frag_ignored_not_found]
      and [stats][decoder][event][ipv4][frag_ignored] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv4_frag_ignored_labels.key" =>
            "stats_decoder_event_ipv4_frag_ignored"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv4_frag_ignored_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv4.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_icmpv4_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv4_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.icmpv4.pkt_too_small}"
        }
        on_error => "stats_decoder_event_icmpv4_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_icmpv4_pkt_too_small_not_found]
      and [stats][decoder][event][icmpv4][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv4_pkt_too_small_labels.key" =>
            "stats_decoder_event_icmpv4_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv4_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv4.unknown_type" => "string"
        }
        on_error => "stats_decoder_event_icmpv4_unknown_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv4_unknown_type_labels.value" =>
          "%{stats.decoder.event.icmpv4.unknown_type}"
        }
        on_error => "stats_decoder_event_icmpv4_unknown_type_not_found"
      }
      if ![stats_decoder_event_icmpv4_unknown_type_not_found]
      and [stats][decoder][event][icmpv4][unknown_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv4_unknown_type_labels.key" =>
            "stats_decoder_event_icmpv4_unknown_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv4_unknown_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv4.unknown_code" => "string"
        }
        on_error => "stats_decoder_event_icmpv4_unknown_code_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv4_unknown_code_labels.value" =>
          "%{stats.decoder.event.icmpv4.unknown_code}"
        }
        on_error => "stats_decoder_event_icmpv4_unknown_code_not_found"
      }
      if ![stats_decoder_event_icmpv4_unknown_code_not_found]
      and [stats][decoder][event][icmpv4][unknown_code] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv4_unknown_code_labels.key" =>
            "stats_decoder_event_icmpv4_unknown_code"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv4_unknown_code_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv4.ipv4_trunc_pkt" => "string"
        }
        on_error => "stats_decoder_event_icmpv4_ipv4_trunc_pkt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv4_ipv4_trunc_pkt_labels.value" =>
          "%{stats.decoder.event.icmpv4.ipv4_trunc_pkt}"
        }
        on_error => "stats_decoder_event_icmpv4_ipv4_trunc_pkt_not_found"
      }
      if ![stats_decoder_event_icmpv4_ipv4_trunc_pkt_not_found]
       and [stats][decoder][event][icmpv4][ipv4_trunc_pkt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv4_ipv4_trunc_pkt_labels.key" =>
            "stats_decoder_event_icmpv4_ipv4_trunc_pkt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv4_ipv4_trunc_pkt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv4.ipv4_unknown_ver" => "string"
        }
        on_error => "ipv4_unknown_ver_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv4_ipv4_unknown_ver_labels.value" =>
          "%{stats.decoder.event.icmpv4.ipv4_unknown_ver}"
        }
        on_error => "stats_decoder_event_icmpv4_ipv4_unknown_ver_not_found"
      }
      if ![stats_decoder_event_icmpv4_ipv4_unknown_ver_not_found]
      and [stats][decoder][event][icmpv4][ipv4_unknown_ver] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv4_ipv4_unknown_ver_labels.key" =>
            "stats_decoder_event_icmpv4_ipv4_unknown_ver"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv4_ipv4_unknown_ver_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.unknown_type" => "string"
        }
        on_error => "stats_decoder_event_icmpv6_unknown_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_unknown_type_labels.value" =>
          "%{stats.decoder.event.icmpv6.unknown_type}"
        }
        on_error => "stats_decoder_event_icmpv6_unknown_type_not_found"
      }
      if ![stats_decoder_event_icmpv6_unknown_type_not_found]
      and [stats][decoder][event][icmpv6][unknown_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_unknown_type_labels.key" =>
            "stats_decoder_event_icmpv6_unknown_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_unknown_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.unknown_code" => "string"
        }
        on_error => "stats_decoder_event_icmpv6_unknown_code_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_unknown_code_labels.value" =>
          "%{stats.decoder.event.icmpv6.unknown_code}"
        }
        on_error => "stats_decoder_event_icmpv6_unknown_code_not_found"
      }
      if ![stats_decoder_event_icmpv6_unknown_code_not_found]
      and [stats][decoder][event][icmpv6][unknown_code] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_unknown_code_labels.key" =>
            "stats_decoder_event_icmpv6_unknown_code"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_unknown_code_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_icmpv6_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.icmpv6.pkt_too_small}"
        }
        on_error => "stats_decoder_event_icmpv6_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_icmpv6_pkt_too_small_not_found]
      and [stats][decoder][event][icmpv6][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_pkt_too_small_labels.key" =>
            "stats_decoder_event_icmpv6_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.ipv6_unknown_version" => "string"
        }
        on_error => "ipv6_unknown_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_ipv6_unknown_version_labels.value" =>
          "%{stats.decoder.event.icmpv6.ipv6_unknown_version}"
        }
        on_error => "stats_decoder_event_icmpv6_ipv6_unknown_version_not_found"
      }
      if ![stats_decoder_event_icmpv6_ipv6_unknown_version_not_found]
      and [stats][decoder][event][icmpv6][ipv6_unknown_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_ipv6_unknown_version_labels.key" =>
            "stats_decoder_event_icmpv6_ipv6_unknown_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_ipv6_unknown_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.ipv6_trunc_pkt" => "string"
        }
        on_error => "stats_decoder_event_icmpv6_ipv6_trunc_pkt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_ipv6_trunc_pkt_labels.value" =>
          "%{stats.decoder.event.icmpv6.ipv6_trunc_pkt}"
        }
        on_error => "stats_decoder_event_icmpv6_ipv6_trunc_pkt_not_found"
      }
      if ![stats_decoder_event_icmpv6_ipv6_trunc_pkt_not_found]
      and [stats][decoder][event][icmpv6][ipv6_trunc_pkt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_ipv6_trunc_pkt_labels.key" =>
            "stats_decoder_event_icmpv6_ipv6_trunc_pkt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_ipv6_trunc_pkt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.mld_message_with_invalid_hl" => "string"
        }
        on_error => "mld_message_with_invalid_hl_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_mld_message_with_invalid_hl_labels.value"
          => "%{stats.decoder.event.icmpv6.mld_message_with_invalid_hl}"
        }
        on_error =>
        "stats_decoder_event_icmpv6_mld_message_with_invalid_hl_not_found"
      }
      if ![stats_decoder_event_icmpv6_mld_message_with_invalid_hl_not_found]
      and [stats][decoder][event][icmpv6][mld_message_with_invalid_hl] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_mld_message_with_invalid_hl_labels.key"
            => "stats_decoder_event_icmpv6_mld_message_with_invalid_hl"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_mld_message_with_invalid_hl_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.unassigned_type" => "string"
        }
        on_error => "icmpv6_unassigned_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_unassigned_type_labels.value" =>
          "%{stats.decoder.event.icmpv6.unassigned_type}"
        }
        on_error => "stats_decoder_event_icmpv6_unassigned_type_not_found"
      }
      if ![stats_decoder_event_icmpv6_unassigned_type_not_found]
      and [stats][decoder][event][icmpv6][unassigned_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_unassigned_type_labels.key" =>
            "stats_decoder_event_icmpv6_unassigned_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_unassigned_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.icmpv6.experimentation_type" => "string"
        }
        on_error => "icmpv6_experimentation_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_icmpv6_experimentation_type_labels.value" =>
          "%{stats.decoder.event.icmpv6.experimentation_type}"
        }
        on_error => "stats_decoder_event_icmpv6_experimentation_type_not_found"
      }
      if ![stats_decoder_event_icmpv6_experimentation_type_not_found]
      and [stats][decoder][event][icmpv6][experimentation_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_icmpv6_experimentation_type_labels.key" =>
            "stats_decoder_event_icmpv6_experimentation_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_icmpv6_experimentation_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ipv6_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ipv6.pkt_too_small}"
        }
        on_error => "stats_decoder_event_ipv6_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ipv6_pkt_too_small_not_found]
      and [stats][decoder][event][ipv6][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_pkt_too_small_labels.key" =>
            "stats_decoder_event_ipv6_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.trunc_pkt" => "string"
        }
        on_error => "stats_decoder_event_ipv6_trunc_pkt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_trunc_pkt_labels.value" =>
          "%{stats.decoder.event.ipv6.trunc_pkt}"
        }
        on_error => "stats_decoder_event_ipv6_trunc_pkt_not_found"
      }
      if ![stats_decoder_event_ipv6_trunc_pkt_not_found]
      and [stats][decoder][event][ipv6][trunc_pkt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_trunc_pkt_labels.key" =>
            "stats_decoder_event_ipv6_trunc_pkt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_trunc_pkt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.trunc_exthdr" => "string"
        }
        on_error => "stats_decoder_event_ipv6_trunc_exthdr_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_trunc_exthdr_labels.value" =>
          "%{stats.decoder.event.ipv6.trunc_exthdr}"
        }
        on_error => "stats_decoder_event_ipv6_trunc_exthdr_not_found"
      }
      if ![stats_decoder_event_ipv6_trunc_exthdr_not_found]
      and [stats][decoder][event][ipv6][trunc_exthdr] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_trunc_exthdr_labels.key" =>
            "stats_decoder_event_ipv6_trunc_exthdr"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_trunc_exthdr_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_fh" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_fh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_fh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_fh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_fh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_fh_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_fh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_fh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_fh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_fh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_useless_fh" => "string"
        }
        on_error => "ipv6_exthdr_useless_fh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_useless_fh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_useless_fh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_useless_fh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_useless_fh_not_found]
      and [stats][decoder][event][ipv6][exthdr_useless_fh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_useless_fh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_useless_fh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_useless_fh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_rh" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_rh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_rh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_rh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_rh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_rh_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_rh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_rh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_rh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_rh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_hh" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_hh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_hh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_hh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_hh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_hh_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_hh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_hh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_hh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_hh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_dh" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_dh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_dh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_dh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_dh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_dh_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_dh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_dh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_dh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_dh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_ah" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_ah_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_ah_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_ah}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_ah_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_ah_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_ah] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_ah_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_ah"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_ah_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_dupl_eh" => "string"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_eh_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_dupl_eh_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_dupl_eh}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_dupl_eh_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_dupl_eh_not_found]
      and [stats][decoder][event][ipv6][exthdr_dupl_eh] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_dupl_eh_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_dupl_eh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_dupl_eh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_invalid_optlen" => "string"
        }
        on_error => "ipv6_exthdr_invalid_optlen_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_invalid_optlen_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_invalid_optlen}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_invalid_optlen_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_invalid_optlen_not_found]
      and [stats][decoder][event][ipv6][exthdr_invalid_optlen] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_invalid_optlen_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_invalid_optlen"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_invalid_optlen_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.wrong_ip_version" => "string"
        }
        on_error => "stats_decoder_event_ipv6_wrong_ip_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_wrong_ip_version_labels.value" =>
          "%{stats.decoder.event.ipv6.wrong_ip_version}"
        }
        on_error => "stats_decoder_event_ipv6_wrong_ip_version_not_found"
      }
      if ![stats_decoder_event_ipv6_wrong_ip_version_not_found]
      and [stats][decoder][event][ipv6][wrong_ip_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_wrong_ip_version_labels.key" =>
            "stats_decoder_event_ipv6_wrong_ip_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_wrong_ip_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.exthdr_ah_res_not_null" => "string"
        }
        on_error => "ipv6_exthdr_ah_res_not_null_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_exthdr_ah_res_not_null_labels.value" =>
          "%{stats.decoder.event.ipv6.exthdr_ah_res_not_null}"
        }
        on_error => "stats_decoder_event_ipv6_exthdr_ah_res_not_null_not_found"
      }
      if ![stats_decoder_event_ipv6_exthdr_ah_res_not_null_not_found]
      and [stats][decoder][event][ipv6][exthdr_ah_res_not_null] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_exthdr_ah_res_not_null_labels.key" =>
            "stats_decoder_event_ipv6_exthdr_ah_res_not_null"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_exthdr_ah_res_not_null_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.hopopts_unknown_opt" => "string"
        }
        on_error => "ipv6_hopopts_unknown_opt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_hopopts_unknown_opt_labels.value" =>
          "%{stats.decoder.event.ipv6.hopopts_unknown_opt}"
        }
        on_error => "stats_decoder_event_ipv6_hopopts_unknown_opt_not_found"
      }
      if ![stats_decoder_event_ipv6_hopopts_unknown_opt_not_found]
      and [stats][decoder][event][ipv6][hopopts_unknown_opt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_hopopts_unknown_opt_labels.key" =>
            "stats_decoder_event_ipv6_hopopts_unknown_opt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_hopopts_unknown_opt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.hopopts_only_padding" => "string"
        }
        on_error => "ipv6_hopopts_only_padding_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_hopopts_only_padding_labels.value" =>
          "%{stats.decoder.event.ipv6.hopopts_only_padding}"
        }
        on_error => "stats_decoder_event_ipv6_hopopts_only_padding_not_found"
      }
      if ![stats_decoder_event_ipv6_hopopts_only_padding_not_found]
      and [stats][decoder][event][ipv6][hopopts_only_padding] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_hopopts_only_padding_labels.key" =>
            "stats_decoder_event_ipv6_hopopts_only_padding"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_hopopts_only_padding_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.dstopts_unknown_opt" => "string"
        }
        on_error => "ipv6_dstopts_unknown_opt_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_dstopts_unknown_opt_labels.value" =>
          "%{stats.decoder.event.ipv6.dstopts_unknown_opt}"
        }
        on_error => "stats_decoder_event_ipv6_dstopts_unknown_opt_not_found"
      }
      if ![stats_decoder_event_ipv6_dstopts_unknown_opt_not_found]
      and [stats][decoder][event][ipv6][dstopts_unknown_opt] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_dstopts_unknown_opt_labels.key" =>
            "stats_decoder_event_ipv6_dstopts_unknown_opt"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_dstopts_unknown_opt_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.dstopts_only_padding" => "string"
        }
        on_error => "ipv6_dstopts_only_padding_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_dstopts_only_padding_labels.value" =>
          "%{stats.decoder.event.ipv6.dstopts_only_padding}"
        }
        on_error => "stats_decoder_event_ipv6_dstopts_only_padding_not_found"
      }
      if ![stats_decoder_event_ipv6_dstopts_only_padding_not_found]
      and [stats][decoder][event][ipv6][dstopts_only_padding] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_dstopts_only_padding_labels.key" =>
            "stats_decoder_event_ipv6_dstopts_only_padding"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_dstopts_only_padding_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.rh_type_0" => "string"
        }
        on_error => "stats_decoder_event_ipv6_rh_type_0_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_rh_type_0_labels.value" =>
          "%{stats.decoder.event.ipv6.rh_type_0}"
        }
        on_error => "stats_decoder_event_ipv6_rh_type_0_not_found"
      }
      if ![stats_decoder_event_ipv6_rh_type_0_not_found]
      and [stats][decoder][event][ipv6][rh_type_0] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_rh_type_0_labels.key" =>
            "stats_decoder_event_ipv6_rh_type_0"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_rh_type_0_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.zero_len_padn" => "string"
        }
        on_error => "stats_decoder_event_ipv6_zero_len_padn_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_zero_len_padn_labels.value" =>
          "%{stats.decoder.event.ipv6.zero_len_padn}"
        }
        on_error => "stats_decoder_event_ipv6_zero_len_padn_not_found"
      }
      if ![stats_decoder_event_ipv6_zero_len_padn_not_found]
      and [stats][decoder][event][ipv6][zero_len_padn] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_zero_len_padn_labels.key" =>
            "stats_decoder_event_ipv6_zero_len_padn"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_zero_len_padn_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.fh_non_zero_reserved_field" => "string"
        }
        on_error => "ipv6_fh_non_zero_reserved_field_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_fh_non_zero_reserved_field_labels.value" =>
          "%{stats.decoder.event.ipv6.fh_non_zero_reserved_field}"
        }
        on_error =>
        "stats_decoder_event_ipv6_fh_non_zero_reserved_field_not_found"
      }
      if ![stats_decoder_event_ipv6_fh_non_zero_reserved_field_not_found]
      and [stats][decoder][event][ipv6][fh_non_zero_reserved_field] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_fh_non_zero_reserved_field_labels.key" =>
            "stats_decoder_event_ipv6_fh_non_zero_reserved_field"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_fh_non_zero_reserved_field_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.data_after_none_header" => "string"
        }
        on_error => "ipv6_data_after_none_header_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_data_after_none_header_labels.value" =>
          "%{stats.decoder.event.ipv6.data_after_none_header}"
        }
        on_error => "stats_decoder_event_ipv6_data_after_none_header_not_found"
      }
      if ![stats_decoder_event_ipv6_data_after_none_header_not_found]
      and [stats][decoder][event][ipv6][data_after_none_header] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_data_after_none_header_labels.key" =>
            "stats_decoder_event_ipv6_data_after_none_header"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_data_after_none_header_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.unknown_next_header" => "string"
        }
        on_error => "ipv6_unknown_next_header_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_unknown_next_header_labels.value" =>
          "%{stats.decoder.event.ipv6.unknown_next_header}"
        }
        on_error => "stats_decoder_event_ipv6_unknown_next_header_not_found"
      }
      if ![stats_decoder_event_ipv6_unknown_next_header_not_found]
      and [stats][decoder][event][ipv6][unknown_next_header] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_unknown_next_header_labels.key" =>
            "stats_decoder_event_ipv6_unknown_next_header"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_unknown_next_header_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.icmpv4" => "string"
        }
        on_error => "stats_decoder_event_ipv6_icmpv4_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_icmpv4_labels.value" =>
          "%{stats.decoder.event.ipv6.icmpv4}"
        }
        on_error => "stats_decoder_event_ipv6_icmpv4_not_found"
      }
      if ![stats_decoder_event_ipv6_icmpv4_not_found]
      and [stats][decoder][event][ipv6][icmpv4] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_icmpv4_labels.key" =>
            "stats_decoder_event_ipv6_icmpv4"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_icmpv4_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.frag_pkt_too_large" => "string"
        }
        on_error => "ipv6_frag_pkt_too_large_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_frag_pkt_too_large_labels.value" =>
          "%{stats.decoder.event.ipv6.frag_pkt_too_large}"
        }
        on_error => "stats_decoder_event_ipv6_frag_pkt_too_large_not_found"
      }
      if ![stats_decoder_event_ipv6_frag_pkt_too_large_not_found]
      and [stats][decoder][event][ipv6][frag_pkt_too_large] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_frag_pkt_too_large_labels.key" =>
            "stats_decoder_event_ipv6_frag_pkt_too_large"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_frag_pkt_too_large_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.frag_overlap" => "string"
        }
        on_error => "stats_decoder_event_ipv6_frag_overlap_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_frag_overlap_labels.value" =>
          "%{stats.decoder.event.ipv6.frag_overlap}"
        }
        on_error => "stats_decoder_event_ipv6_frag_overlap_not_found"
      }
      if ![stats_decoder_event_ipv6_frag_overlap_not_found]
      and [stats][decoder][event][ipv6][frag_overlap] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_frag_overlap_labels.key" =>
            "stats_decoder_event_ipv6_frag_overlap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_frag_overlap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.frag_invalid_length" => "string"
        }
        on_error => "ipv6_frag_invalid_length_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_frag_invalid_length_labels.value" =>
          "%{stats.decoder.event.ipv6.frag_invalid_length}"
        }
        on_error => "stats_decoder_event_ipv6_frag_invalid_length_not_found"
      }
      if ![stats_decoder_event_ipv6_frag_invalid_length_not_found]
      and [stats][decoder][event][ipv6][frag_invalid_length] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_frag_invalid_length_labels.key" =>
            "stats_decoder_event_ipv6_frag_invalid_length"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_frag_invalid_length_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.frag_ignored" => "string"
        }
        on_error => "stats_decoder_event_ipv6_frag_ignored_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_frag_ignored_labels.value" =>
          "%{stats.decoder.event.ipv6.frag_ignored}"
        }
        on_error => "stats_decoder_event_ipv6_frag_ignored_not_found"
      }
      if ![stats_decoder_event_ipv6_frag_ignored_not_found]
      and [stats][decoder][event][ipv6][frag_ignored] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_frag_ignored_labels.key" =>
            "stats_decoder_event_ipv6_frag_ignored"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_frag_ignored_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.ipv4_in_ipv6_too_small" => "string"
        }
        on_error => "ipv6_ipv4_in_ipv6_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_ipv4_in_ipv6_too_small_labels.value" =>
          "%{stats.decoder.event.ipv6.ipv4_in_ipv6_too_small}"
        }
        on_error => "stats_decoder_event_ipv6_ipv4_in_ipv6_too_small_not_found"
      }
      if ![stats_decoder_event_ipv6_ipv4_in_ipv6_too_small_not_found]
      and [stats][decoder][event][ipv6][ipv4_in_ipv6_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_ipv4_in_ipv6_too_small_labels.key" =>
            "stats_decoder_event_ipv6_ipv4_in_ipv6_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_ipv4_in_ipv6_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.ipv4_in_ipv6_wrong_version" => "string"
        }
        on_error => "ipv6_ipv4_in_ipv6_wrong_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_ipv4_in_ipv6_wrong_version_labels.value" =>
          "%{stats.decoder.event.ipv6.ipv4_in_ipv6_wrong_version}"
        }
        on_error => "ipv6_ipv4_in_ipv6_wrong_version_not_found"
      }
      if ![ipv6_ipv4_in_ipv6_wrong_version_not_found]
      and [stats][decoder][event][ipv6][ipv4_in_ipv6_wrong_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_ipv4_in_ipv6_wrong_version_labels.key" =>
            "stats_decoder_event_ipv6_ipv4_in_ipv6_wrong_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_ipv4_in_ipv6_wrong_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.ipv6_in_ipv6_too_small" => "string"
        }
        on_error => "ipv6_ipv6_in_ipv6_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_ipv6_in_ipv6_too_small_labels.value" =>
          "%{stats.decoder.event.ipv6.ipv6_in_ipv6_too_small}"
        }
        on_error => "stats_decoder_event_ipv6_ipv6_in_ipv6_too_small_not_found"
      }
      if ![stats_decoder_event_ipv6_ipv6_in_ipv6_too_small_not_found]
      and [stats][decoder][event][ipv6][ipv6_in_ipv6_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_ipv6_in_ipv6_too_small_labels.key" =>
            "stats_decoder_event_ipv6_ipv6_in_ipv6_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_ipv6_in_ipv6_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipv6.ipv6_in_ipv6_wrong_version" => "string"
        }
        on_error => "ipv6_ipv6_in_ipv6_wrong_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version_labels.value" =>
          "%{stats.decoder.event.ipv6.ipv6_in_ipv6_wrong_version}"
        }
        on_error =>
        "stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version_not_found"
      }
      if ![stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version_not_found]
      and [stats][decoder][event][ipv6][ipv6_in_ipv6_wrong_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version_labels.key" =>
            "stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipv6_ipv6_in_ipv6_wrong_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.tcp.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_tcp_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_tcp_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.tcp.pkt_too_small}"
        }
        on_error => "stats_decoder_event_tcp_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_tcp_pkt_too_small_not_found]
      and [stats][decoder][event][tcp][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_tcp_pkt_too_small_labels.key" =>
            "stats_decoder_event_tcp_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_tcp_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.tcp.hlen_too_small" => "string"
        }
        on_error => "stats_decoder_event_tcp_hlen_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_tcp_hlen_too_small_labels.value" =>
          "%{stats.decoder.event.tcp.hlen_too_small}"
        }
        on_error => "stats_decoder_event_tcp_hlen_too_small_not_found"
      }
      if ![stats_decoder_event_tcp_hlen_too_small_not_found]
      and [stats][decoder][event][tcp][hlen_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_tcp_hlen_too_small_labels.key" =>
            "stats_decoder_event_tcp_hlen_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_tcp_hlen_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.tcp.invalid_optlen" => "string"
        }
        on_error => "stats_decoder_event_tcp_invalid_optlen_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_tcp_invalid_optlen_labels.value" =>
          "%{stats.decoder.event.tcp.invalid_optlen}"
        }
        on_error => "stats_decoder_event_tcp_invalid_optlen_not_found"
      }
      if ![stats_decoder_event_tcp_invalid_optlen_not_found]
      and [stats][decoder][event][tcp][invalid_optlen] != "" {
        mutate {
          replace => {
            "stats_decoder_event_tcp_invalid_optlen_labels.key" =>
            "stats_decoder_event_tcp_invalid_optlen"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_tcp_invalid_optlen_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.tcp.opt_invalid_len" => "string"
        }
        on_error => "stats_decoder_event_tcp_opt_invalid_len_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_tcp_opt_invalid_len_labels.value" =>
          "%{stats.decoder.event.tcp.opt_invalid_len}"
        }
        on_error => "stats_decoder_event_tcp_opt_invalid_len_not_found"
      }
      if ![stats_decoder_event_tcp_opt_invalid_len_not_found]
      and [stats][decoder][event][tcp][opt_invalid_len] != "" {
        mutate {
          replace => {
            "stats_decoder_event_tcp_opt_invalid_len_labels.key" =>
            "stats_decoder_event_tcp_opt_invalid_len"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_tcp_opt_invalid_len_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.tcp.opt_duplicate" => "string"
        }
        on_error => "stats_decoder_event_tcp_opt_duplicate_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_tcp_opt_duplicate_labels.value" =>
          "%{stats.decoder.event.tcp.opt_duplicate}"
        }
        on_error => "stats_decoder_event_tcp_opt_duplicate_not_found"
      }
      if ![stats_decoder_event_tcp_opt_duplicate_not_found]
      and [stats][decoder][event][tcp][opt_duplicate] != "" {
        mutate {
          replace => {
            "stats_decoder_event_tcp_opt_duplicate_labels.key" =>
            "stats_decoder_event_tcp_opt_duplicate"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_tcp_opt_duplicate_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.udp.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_udp_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_udp_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.udp.pkt_too_small}"
        }
        on_error => "stats_decoder_event_udp_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_udp_pkt_too_small_not_found]
      and [stats][decoder][event][udp][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_udp_pkt_too_small_labels.key" =>
            "stats_decoder_event_udp_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_udp_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.udp.hlen_too_small" => "string"
        }
        on_error => "stats_decoder_event_udp_hlen_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_udp_hlen_too_small_labels.value" =>
          "%{stats.decoder.event.udp.hlen_too_small}"
        }
        on_error => "stats_decoder_event_udp_hlen_too_small_not_found"
      }
      if ![stats_decoder_event_udp_hlen_too_small_not_found]
      and [stats][decoder][event][udp][hlen_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_udp_hlen_too_small_labels.key" =>
            "stats_decoder_event_udp_hlen_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_udp_hlen_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.udp.hlen_invalid" => "string"
        }
        on_error => "stats_decoder_event_udp_hlen_invalid_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_udp_hlen_invalid_labels.value" =>
          "%{stats.decoder.event.udp.hlen_invalid}"
        }
        on_error => "stats_decoder_event_udp_hlen_invalid_not_found"
      }
      if ![stats_decoder_event_udp_hlen_invalid_not_found]
      and [stats][decoder][event][udp][hlen_invalid] != "" {
        mutate {
          replace => {
            "stats_decoder_event_udp_hlen_invalid_labels.key" =>
            "stats_decoder_event_udp_hlen_invalid"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_udp_hlen_invalid_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.udp.len_invalid" => "string"
        }
        on_error => "stats_decoder_event_udp_len_invalid_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_udp_len_invalid_labels.value" =>
          "%{stats.decoder.event.udp.len_invalid}"
        }
        on_error => "stats_decoder_event_udp_len_invalid_not_found"
      }
      if ![stats_decoder_event_udp_len_invalid_not_found]
      and [stats][decoder][event][udp][len_invalid] != "" {
        mutate {
          replace => {
            "stats_decoder_event_udp_len_invalid_labels.key" =>
            "stats_decoder_event_udp_len_invalid"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_udp_len_invalid_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.sll.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_sll_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_sll_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.sll.pkt_too_small}"
        }
        on_error => "stats_decoder_event_sll_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_sll_pkt_too_small_not_found]
      and [stats][decoder][event][sll][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_sll_pkt_too_small_labels.key" =>
            "stats_decoder_event_sll_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_sll_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ethernet.pkt_too_small" => "string"
        }
        on_error => "ethernet_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ethernet_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ethernet.pkt_too_small}"
        }
        on_error => "stats_decoder_event_ethernet_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ethernet_pkt_too_small_not_found]
      and [stats][decoder][event][ethernet][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ethernet_pkt_too_small_labels.key" =>
            "stats_decoder_event_ethernet_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ethernet_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ppp_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ppp.pkt_too_small}"
        }
        on_error => "stats_decoder_event_ppp_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ppp_pkt_too_small_not_found]
      and [stats][decoder][event][ppp][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_pkt_too_small_labels.key" =>
            "stats_decoder_event_ppp_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.vju_pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ppp_vju_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_vju_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ppp.vju_pkt_too_small}"
        }
        on_error => "stats_decoder_event_ppp_vju_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ppp_vju_pkt_too_small_not_found]
      and [stats][decoder][event][ppp][vju_pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_vju_pkt_too_small_labels.key" =>
            "stats_decoder_event_ppp_vju_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_vju_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.ip4_pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ppp_ip4_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_ip4_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ppp.ip4_pkt_too_small}"
        }
        on_error => "stats_decoder_event_ppp_ip4_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ppp_ip4_pkt_too_small_not_found]
      and [stats][decoder][event][ppp][ip4_pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_ip4_pkt_too_small_labels.key" =>
            "stats_decoder_event_ppp_ip4_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_ip4_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.ip6_pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ppp_ip6_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_ip6_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ppp.ip6_pkt_too_small}"
        }
        on_error => "stats_decoder_event_ppp_ip6_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ppp_ip6_pkt_too_small_not_found]
      and [stats][decoder][event][ppp][ip6_pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_ip6_pkt_too_small_labels.key" =>
            "stats_decoder_event_ppp_ip6_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_ip6_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.wrong_type" => "string"
        }
        on_error => "stats_decoder_event_ppp_wrong_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_wrong_type_labels.value" =>
          "%{stats.decoder.event.ppp.wrong_type}"
        }
        on_error => "stats_decoder_event_ppp_wrong_type_not_found"
      }
      if ![stats_decoder_event_ppp_wrong_type_not_found]
      and [stats][decoder][event][ppp][wrong_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_wrong_type_labels.key" =>
            "stats_decoder_event_ppp_wrong_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_wrong_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ppp.unsup_proto" => "string"
        }
        on_error => "stats_decoder_event_ppp_unsup_proto_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ppp_unsup_proto_labels.value" =>
          "%{stats.decoder.event.ppp.unsup_proto}"
        }
        on_error => "stats_decoder_event_ppp_unsup_proto_not_found"
      }
      if ![stats_decoder_event_ppp_unsup_proto_not_found]
      and [stats][decoder][event][ppp][unsup_proto] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ppp_unsup_proto_labels.key" =>
            "stats_decoder_event_ppp_unsup_proto"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ppp_unsup_proto_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.pppoe.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_pppoe_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_pppoe_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.pppoe.pkt_too_small}"
        }
        on_error => "stats_decoder_event_pppoe_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_pppoe_pkt_too_small_not_found]
      and [stats][decoder][event][pppoe][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_pppoe_pkt_too_small_labels.key" =>
            "stats_decoder_event_pppoe_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_pppoe_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.pppoe.wrong_code" => "string"
        }
        on_error => "stats_decoder_event_pppoe_wrong_code_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_pppoe_wrong_code_labels.value" =>
          "%{stats.decoder.event.pppoe.wrong_code}"
        }
        on_error => "stats_decoder_event_pppoe_wrong_code_not_found"
      }
      if ![stats_decoder_event_pppoe_wrong_code_not_found]
      and [stats][decoder][event][pppoe][wrong_code] != "" {
        mutate {
          replace => {
            "stats_decoder_event_pppoe_wrong_code_labels.key" =>
            "stats_decoder_event_pppoe_wrong_code"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_pppoe_wrong_code_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.pppoe.malformed_tags" => "string"
        }
        on_error => "stats_decoder_event_pppoe_malformed_tags_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_pppoe_malformed_tags_labels.value" =>
          "%{stats.decoder.event.pppoe.malformed_tags}"
        }
        on_error => "stats_decoder_event_pppoe_malformed_tags_not_found"
      }
      if ![stats_decoder_event_pppoe_malformed_tags_not_found]
      and [stats][decoder][event][pppoe][malformed_tags] != "" {
        mutate {
          replace => {
            "stats_decoder_event_pppoe_malformed_tags_labels.key" =>
            "stats_decoder_event_pppoe_malformed_tags"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_pppoe_malformed_tags_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_gre_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.gre.pkt_too_small}"
        }
        on_error => "stats_decoder_event_gre_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_gre_pkt_too_small_not_found]
      and [stats][decoder][event][gre][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_pkt_too_small_labels.key" =>
            "stats_decoder_event_gre_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.wrong_version" => "string"
        }
        on_error => "stats_decoder_event_gre_wrong_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_wrong_version_labels.value" =>
          "%{stats.decoder.event.gre.wrong_version}"
        }
        on_error => "stats_decoder_event_gre_wrong_version_not_found"
      }
      if ![stats_decoder_event_gre_wrong_version_not_found]
      and [stats][decoder][event][gre][wrong_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_wrong_version_labels.key" =>
            "stats_decoder_event_gre_wrong_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_wrong_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version0_recur" => "string"
        }
        on_error => "stats_decoder_event_gre_version0_recur_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version0_recur_labels.value" =>
          "%{stats.decoder.event.gre.version0_recur}"
        }
        on_error => "stats_decoder_event_gre_version0_recur_not_found"
      }
      if ![stats_decoder_event_gre_version0_recur_not_found]
      and [stats][decoder][event][gre][version0_recur] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version0_recur_labels.key" =>
            "stats_decoder_event_gre_version0_recur"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version0_recur_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version0_flags" => "string"
        }
        on_error => "stats_decoder_event_gre_version0_flags_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version0_flags_labels.value" =>
          "%{stats.decoder.event.gre.version0_flags}"
        }
        on_error => "stats_decoder_event_gre_version0_flags_not_found"
      }
      if ![stats_decoder_event_gre_version0_flags_not_found]
      and [stats][decoder][event][gre][version0_flags] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version0_flags_labels.key" =>
            "stats_decoder_event_gre_version0_flags"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version0_flags_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version0_hdr_too_big" => "string"
        }
        on_error => "gre_version0_hdr_too_big_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version0_hdr_too_big_labels.value" => "
          %{stats.decoder.event.gre.version0_hdr_too_big}"
        }
        on_error => "stats_decoder_event_gre_version0_hdr_too_big_not_found"
      }
      if ![stats_decoder_event_gre_version0_hdr_too_big_not_found]
      and [stats][decoder][event][gre][version0_hdr_too_big] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version0_hdr_too_big_labels.key" =>
            "stats_decoder_event_gre_version0_hdr_too_big"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version0_hdr_too_big_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version0_malformed_sre_hdr" => "string"
        }
        on_error => "gre_version0_malformed_sre_hdr_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version0_malformed_sre_hdr_labels.value" =>
          "%{stats.decoder.event.gre.version0_malformed_sre_hdr}"
        }
        on_error => "gre_version0_malformed_sre_hdr_not_found"
      }
      if ![gre_version0_malformed_sre_hdr_not_found]
      and [stats][decoder][event][gre][version0_malformed_sre_hdr] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version0_malformed_sre_hdr_labels.key" =>
            "stats_decoder_event_gre_version0_malformed_sre_hdr"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version0_malformed_sre_hdr_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_chksum" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_chksum_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_chksum_labels.value" =>
          "%{stats.decoder.event.gre.version1_chksum}"
        }
        on_error => "stats_decoder_event_gre_version1_chksum_not_found"
      }
      if ![stats_decoder_event_gre_version1_chksum_not_found]
      and [stats][decoder][event][gre][version1_chksum] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_chksum_labels.key" =>
            "stats_decoder_event_gre_version1_chksum"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_chksum_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_route" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_route_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_route_labels.value" =>
          "%{stats.decoder.event.gre.version1_route}"
        }
        on_error => "stats_decoder_event_gre_version1_route_not_found"
      }
      if ![stats_decoder_event_gre_version1_route_not_found]
      and [stats][decoder][event][gre][version1_route] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_route_labels.key" =>
            "stats_decoder_event_gre_version1_route"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_route_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_ssr" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_ssr_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_ssr_labels.value" =>
          "%{stats.decoder.event.gre.version1_ssr}"
        }
        on_error => "stats_decoder_event_gre_version1_ssr_not_found"
      }
      if ![stats_decoder_event_gre_version1_ssr_not_found]
      and [stats][decoder][event][gre][version1_ssr] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_ssr_labels.key" =>
            "stats_decoder_event_gre_version1_ssr"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_ssr_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_recur" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_recur_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_recur_labels.value" =>
          "%{stats.decoder.event.gre.version1_recur}"
        }
        on_error => "stats_decoder_event_gre_version1_recur_not_found"
      }
      if ![stats_decoder_event_gre_version1_recur_not_found]
      and [stats][decoder][event][gre][version1_recur] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_recur_labels.key" =>
            "stats_decoder_event_gre_version1_recur"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_recur_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_flags" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_flags_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_flags_labels.value" =>
          "%{stats.decoder.event.gre.version1_flags}"
        }
        on_error => "stats_decoder_event_gre_version1_flags_not_found"
      }
      if ![stats_decoder_event_gre_version1_flags_not_found]
      and [stats][decoder][event][gre][version1_flags] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_flags_labels.key" =>
            "stats_decoder_event_gre_version1_flags"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_flags_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_no_key" => "string"
        }
        on_error => "stats_decoder_event_gre_version1_no_key_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_no_key_labels.value" =>
          "%{stats.decoder.event.gre.version1_no_key}"
        }
        on_error => "stats_decoder_event_gre_version1_no_key_not_found"
      }
      if ![stats_decoder_event_gre_version1_no_key_not_found]
      and [stats][decoder][event][gre][version1_no_key] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_no_key_labels.key" =>
            "stats_decoder_event_gre_version1_no_key"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_no_key_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_wrong_protocol" => "string"
        }
        on_error => "gre_version1_wrong_protocol_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_wrong_protocol_labels.value" =>
          "%{stats.decoder.event.gre.version1_wrong_protocol}"
        }
        on_error => "stats_decoder_event_gre_version1_wrong_protocol_not_found"
      }
      if ![stats_decoder_event_gre_version1_wrong_protocol_not_found]
      and [stats][decoder][event][gre][version1_wrong_protocol] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_wrong_protocol_labels.key" =>
            "stats_decoder_event_gre_version1_wrong_protocol"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_wrong_protocol_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_malformed_sre_hdr" => "string"
        }
        on_error => "gre_version1_malformed_sre_hdr_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_malformed_sre_hdr_labels.value" =>
          "%{stats.decoder.event.gre.version1_malformed_sre_hdr}"
        }
        on_error => "gre_version1_malformed_sre_hdr_not_found"
      }
      if ![gre_version1_malformed_sre_hdr_not_found]
      and [stats][decoder][event][gre][version1_malformed_sre_hdr] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_malformed_sre_hdr_labels.key" =>
            "stats_decoder_event_gre_version1_malformed_sre_hdr"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_malformed_sre_hdr_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.gre.version1_hdr_too_big" => "string"
        }
        on_error => "gre_version1_hdr_too_big_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_gre_version1_hdr_too_big_labels.value" =>
          "%{stats.decoder.event.gre.version1_hdr_too_big}"
        }
        on_error => "stats_decoder_event_gre_version1_hdr_too_big_not_found"
      }
      if ![stats_decoder_event_gre_version1_hdr_too_big_not_found]
      and [stats][decoder][event][gre][version1_hdr_too_big] != "" {
        mutate {
          replace => {
            "stats_decoder_event_gre_version1_hdr_too_big_labels.key" =>
            "stats_decoder_event_gre_version1_hdr_too_big"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_gre_version1_hdr_too_big_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vlan.header_too_small" => "string"
        }
        on_error => "stats_decoder_event_vlan_header_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vlan_header_too_small_labels.value" =>
          "%{stats.decoder.event.vlan.header_too_small}"
        }
        on_error => "stats_decoder_event_vlan_header_too_small_not_found"
      }
      if ![stats_decoder_event_vlan_header_too_small_not_found]
      and [stats][decoder][event][vlan][header_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vlan_header_too_small_labels.key" =>
            "stats_decoder_event_vlan_header_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vlan_header_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vlan.unknown_type" => "string"
        }
        on_error => "stats_decoder_event_vlan_unknown_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vlan_unknown_type_labels.value" =>
          "%{stats.decoder.event.vlan.unknown_type}"
        }
        on_error => "stats_decoder_event_vlan_unknown_type_not_found"
      }
      if ![stats_decoder_event_vlan_unknown_type_not_found]
      and [stats][decoder][event][vlan][unknown_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vlan_unknown_type_labels.key" =>
            "stats_decoder_event_vlan_unknown_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vlan_unknown_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vlan.too_many_layers" => "string"
        }
        on_error => "stats_decoder_event_vlan_too_many_layers_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vlan_too_many_layers_labels.value" =>
          "%{stats.decoder.event.vlan.too_many_layers}"
        }
        on_error => "stats_decoder_event_vlan_too_many_layers_not_found"
      }
      if ![stats_decoder_event_vlan_too_many_layers_not_found]
      and [stats][decoder][event][vlan][too_many_layers] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vlan_too_many_layers_labels.key" =>
            "stats_decoder_event_vlan_too_many_layers"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vlan_too_many_layers_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ieee8021ah.header_too_small" => "string"
        }
        on_error => "ieee8021ah_header_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ieee8021ah_header_too_small_labels.value" =>
          "%{stats.decoder.event.ieee8021ah.header_too_small}"
        }
        on_error => "stats_decoder_event_ieee8021ah_header_too_small_not_found"
      }
      if ![stats_decoder_event_ieee8021ah_header_too_small_not_found]
      and [stats][decoder][event][ieee8021ah][header_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ieee8021ah_header_too_small_labels.key" =>
            "stats_decoder_event_ieee8021ah_header_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ieee8021ah_header_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vntag.header_too_small" => "string"
        }
        on_error => "vntag_header_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vntag_header_too_small_labels.value" =>
          "%{stats.decoder.event.vntag.header_too_small}"
        }
        on_error => "stats_decoder_event_vntag_header_too_small_not_found"
      }
      if ![stats_decoder_event_vntag_header_too_small_not_found]
      and [stats][decoder][event][vntag][header_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vntag_header_too_small_labels.key" =>
            "stats_decoder_event_vntag_header_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vntag_header_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vntag.unknown_type" => "string"
        }
        on_error => "stats_decoder_event_vntag_unknown_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vntag_unknown_type_labels.value" =>
          "%{stats.decoder.event.vntag.unknown_type}"
        }
        on_error => "stats_decoder_event_vntag_unknown_type_not_found"
      }
      if ![stats_decoder_event_vntag_unknown_type_not_found]
      and [stats][decoder][event][vntag][unknown_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vntag_unknown_type_labels.key" =>
            "stats_decoder_event_vntag_unknown_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vntag_unknown_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ipraw.invalid_ip_version" => "string"
        }
        on_error => "ipraw_invalid_ip_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ipraw_invalid_ip_version_labels.value" =>
          "%{stats.decoder.event.ipraw.invalid_ip_version}"
        }
        on_error => "stats_decoder_event_ipraw_invalid_ip_version_not_found"
      }
      if ![stats_decoder_event_ipraw_invalid_ip_version_not_found]
      and [stats][decoder][event][ipraw][invalid_ip_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ipraw_invalid_ip_version_labels.key" =>
            "stats_decoder_event_ipraw_invalid_ip_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ipraw_invalid_ip_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ltnull.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_ltnull_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ltnull_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.ltnull.pkt_too_small}"
        }
        on_error => "stats_decoder_event_ltnull_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_ltnull_pkt_too_small_not_found]
      and [stats][decoder][event][ltnull][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ltnull_pkt_too_small_labels.key" =>
            "stats_decoder_event_ltnull_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ltnull_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.ltnull.unsupported_type" => "string"
        }
        on_error => "ltnull_unsupported_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_ltnull_unsupported_type_labels.value" =>
          "%{stats.decoder.event.ltnull.unsupported_type}"
        }
        on_error => "stats_decoder_event_ltnull_unsupported_type_not_found"
      }
      if ![stats_decoder_event_ltnull_unsupported_type_not_found]
      and [stats][decoder][event][ltnull][unsupported_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_ltnull_unsupported_type_labels.key" =>
            "stats_decoder_event_ltnull_unsupported_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_ltnull_unsupported_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.sctp.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_sctp_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_sctp_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.sctp.pkt_too_small}"
        }
        on_error => "stats_decoder_event_sctp_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_sctp_pkt_too_small_not_found]
      and [stats][decoder][event][sctp][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_sctp_pkt_too_small_labels.key" =>
            "stats_decoder_event_sctp_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_sctp_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.header_too_small" => "string"
        }
        on_error => "stats_decoder_event_mpls_header_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_header_too_small_labels.value" =>
          "%{stats.decoder.event.mpls.header_too_small}"
        }
        on_error => "stats_decoder_event_mpls_header_too_small_not_found"
      }
      if ![stats_decoder_event_mpls_header_too_small_not_found]
      and [stats][decoder][event][mpls][header_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_header_too_small_labels.key" =>
            "stats_decoder_event_mpls_header_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_header_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_mpls_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.mpls.pkt_too_small}"
        }
        on_error => "stats_decoder_event_mpls_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_mpls_pkt_too_small_not_found]
      and [stats][decoder][event][mpls][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_pkt_too_small_labels.key" =>
            "stats_decoder_event_mpls_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.bad_label_router_alert" => "string"
        }
        on_error => "mpls_bad_label_router_alert_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_bad_label_router_alert_labels.value" =>
          "%{stats.decoder.event.mpls.bad_label_router_alert}"
        }
        on_error => "stats_decoder_event_mpls_bad_label_router_alert_not_found"
      }
      if ![stats_decoder_event_mpls_bad_label_router_alert_not_found]
      and [stats][decoder][event][mpls][bad_label_router_alert] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_bad_label_router_alert_labels.key" =>
            "stats_decoder_event_mpls_bad_label_router_alert"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_bad_label_router_alert_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.bad_label_implicit_null" => "string"
        }
        on_error => "mpls_bad_label_implicit_null_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_bad_label_implicit_null_labels.value" =>
          "%{stats.decoder.event.mpls.bad_label_implicit_null}"
        }
        on_error => "stats_decoder_event_mpls_bad_label_implicit_null_not_found"
      }
      if ![stats_decoder_event_mpls_bad_label_implicit_null_not_found]
      and [stats][decoder][event][mpls][bad_label_implicit_null] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_bad_label_implicit_null_labels.key" =>
            "stats_decoder_event_mpls_bad_label_implicit_null"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_bad_label_implicit_null_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.bad_label_reserved" => "string"
        }
        on_error => "mpls_bad_label_reserved_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_bad_label_reserved_labels.value" =>
          "%{stats.decoder.event.mpls.bad_label_reserved}"
        }
        on_error => "stats_decoder_event_mpls_bad_label_reserved_not_found"
      }
      if ![stats_decoder_event_mpls_bad_label_reserved_not_found]
      and [stats][decoder][event][mpls][bad_label_reserved] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_bad_label_reserved_labels.key" =>
            "stats_decoder_event_mpls_bad_label_reserved"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_bad_label_reserved_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.mpls.unknown_payload_type" => "string"
        }
        on_error => "mpls_unknown_payload_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_mpls_unknown_payload_type_labels.value" =>
          "%{stats.decoder.event.mpls.unknown_payload_type}"
        }
        on_error => "stats_decoder_event_mpls_unknown_payload_type_not_found"
      }
      if ![stats_decoder_event_mpls_unknown_payload_type_not_found]
      and [stats][decoder][event][mpls][unknown_payload_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_mpls_unknown_payload_type_labels.key" =>
            "stats_decoder_event_mpls_unknown_payload_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_mpls_unknown_payload_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.vxlan.unknown_payload_type" => "string"
        }
        on_error => "vxlan_unknown_payload_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_vxlan_unknown_payload_type_labels.value" =>
          "%{stats.decoder.event.vxlan.unknown_payload_type}"
        }
        on_error => "stats_decoder_event_vxlan_unknown_payload_type_not_found"
      }
      if ![stats_decoder_event_vxlan_unknown_payload_type_not_found]
      and [stats][decoder][event][vxlan][unknown_payload_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_vxlan_unknown_payload_type_labels.key" =>
            "stats_decoder_event_vxlan_unknown_payload_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_vxlan_unknown_payload_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.geneve.unknown_payload_type" => "string"
        }
        on_error => "geneve_unknown_payload_type_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_geneve_unknown_payload_type_labels.value" =>
          "%{stats.decoder.event.geneve.unknown_payload_type}"
        }
        on_error => "stats_decoder_event_geneve_unknown_payload_type_not_found"
      }
      if ![stats_decoder_event_geneve_unknown_payload_type_not_found]
      and [stats][decoder][event][geneve][unknown_payload_type] != "" {
        mutate {
          replace => {
            "stats_decoder_event_geneve_unknown_payload_type_labels.key" =>
            "stats_decoder_event_geneve_unknown_payload_type"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_geneve_unknown_payload_type_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.erspan.header_too_small" => "string"
        }
        on_error => "erspan_header_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_erspan_header_too_small_labels.value" =>
          "%{stats.decoder.event.erspan.header_too_small}"
        }
        on_error => "stats_decoder_event_erspan_header_too_small_not_found"
      }
      if ![stats_decoder_event_erspan_header_too_small_not_found]
      and [stats][decoder][event][erspan][header_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_erspan_header_too_small_labels.key" =>
            "stats_decoder_event_erspan_header_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_erspan_header_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.erspan.unsupported_version" => "string"
        }
        on_error => "erspan_unsupported_version_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_erspan_unsupported_version_labels.value" =>
          "%{stats.decoder.event.erspan.unsupported_version}"
        }
        on_error => "stats_decoder_event_erspan_unsupported_version_not_found"
      }
      if ![stats_decoder_event_erspan_unsupported_version_not_found]
      and [stats][decoder][event][erspan][unsupported_version] != "" {
        mutate {
          replace => {
            "stats_decoder_event_erspan_unsupported_version_labels.key" =>
            "stats_decoder_event_erspan_unsupported_version"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_erspan_unsupported_version_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.erspan.too_many_vlan_layers" => "string"
        }
        on_error => "erspan_too_many_vlan_layers_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_erspan_too_many_vlan_layers_labels.value" =>
          "%{stats.decoder.event.erspan.too_many_vlan_layers}"
        }
        on_error => "stats_decoder_event_erspan_too_many_vlan_layers_not_found"
      }
      if ![stats_decoder_event_erspan_too_many_vlan_layers_not_found]
      and [stats][decoder][event][erspan][too_many_vlan_layers] != "" {
        mutate {
          replace => {
            "stats_decoder_event_erspan_too_many_vlan_layers_labels.key" =>
            "stats_decoder_event_erspan_too_many_vlan_layers"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_erspan_too_many_vlan_layers_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.dce.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_dce_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_dce_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.dce.pkt_too_small}"
        }
        on_error => "stats_decoder_event_dce_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_dce_pkt_too_small_not_found]
      and [stats][decoder][event][dce][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_dce_pkt_too_small_labels.key" =>
            "stats_decoder_event_dce_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_dce_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.event.chdlc.pkt_too_small" => "string"
        }
        on_error => "stats_decoder_event_chdlc_pkt_too_small_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_event_chdlc_pkt_too_small_labels.value" =>
          "%{stats.decoder.event.chdlc.pkt_too_small}"
        }
        on_error => "stats_decoder_event_chdlc_pkt_too_small_not_found"
      }
      if ![stats_decoder_event_chdlc_pkt_too_small_not_found]
      and [stats][decoder][event][chdlc][pkt_too_small] != "" {
        mutate {
          replace => {
            "stats_decoder_event_chdlc_pkt_too_small_labels.key" =>
            "stats_decoder_event_chdlc_pkt_too_small"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_event_chdlc_pkt_too_small_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.decoder.too_many_layers" => "string"
        }
        on_error => "stats_decoder_too_many_layers_conversion_error"
      }

      mutate {
        replace => {
          "stats_decoder_too_many_layers_labels.value" =>
          "%{stats.decoder.too_many_layers}"
        }
        on_error => "stats_decoder_too_many_layers_not_found"
      }
      if ![stats_decoder_too_many_layers_not_found]
      and [stats][decoder][too_many_layers] != "" {
        mutate {
          replace => {
            "stats_decoder_too_many_layers_labels.key" =>
            "stats_decoder_too_many_layers"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_decoder_too_many_layers_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.memcap" => "string"
        }
        on_error => "stats_flow_memcap_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_memcap_labels.value" => "%{stats.flow.memcap}"
        }
        on_error => "stats_flow_memcap_not_found"
      }
      if ![stats_flow_memcap_not_found] and [stats][flow][memcap] != "" {
        mutate {
          replace => {
            "stats_flow_memcap_labels.key" => "stats_flow_memcap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_memcap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.tcp" => "string"
        }
        on_error => "stats_flow_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_tcp_labels.value" => "%{stats.flow.tcp}"
        }
        on_error => "stats_flow_tcp_not_found"
      }
      if ![stats_flow_tcp_not_found] and [stats][flow][tcp] != "" {
        mutate {
          replace => {
            "stats_flow_tcp_labels.key" => "stats_flow_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.udp" => "string"
        }
        on_error => "stats_flow_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_udp_labels.value" => "%{stats.flow.udp}"
        }
        on_error => "stats_flow_udp_not_found"
      }
      if ![stats_flow_udp_not_found] and [stats][flow][udp] != "" {
        mutate {
          replace => {
            "stats_flow_udp_labels.key" => "stats_flow_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.icmpv4" => "string"
        }
        on_error => "stats_flow_icmpv4_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_icmpv4_labels.value" => "%{stats.flow.icmpv4}"
        }
        on_error => "stats_flow_icmpv4_not_found"
      }
      if ![stats_flow_icmpv4_not_found] and [stats][flow][icmpv4] != "" {
        mutate {
          replace => {
            "stats_flow_icmpv4_labels.key" => "stats_flow_icmpv4"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_icmpv4_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.icmpv6" => "string"
        }
        on_error => "stats_flow_icmpv6_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_icmpv6_labels.value" => "%{stats.flow.icmpv6}"
        }
        on_error => "stats_flow_icmpv6_not_found"
      }
      if ![stats_flow_icmpv6_not_found] and [stats][flow][icmpv6] != "" {
        mutate {
          replace => {
            "stats_flow_icmpv6_labels.key" => "stats_flow_icmpv6"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_icmpv6_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.tcp_reuse" => "string"
        }
        on_error => "stats_flow_tcp_reuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_tcp_reuse_labels.value" => "%{stats.flow.tcp_reuse}"
        }
        on_error => "stats_flow_tcp_reuse_not_found"
      }
      if ![stats_flow_tcp_reuse_not_found] and [stats][flow][tcp_reuse] != "" {
        mutate {
          replace => {
            "stats_flow_tcp_reuse_labels.key" => "stats_flow_tcp_reuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_tcp_reuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.get_used" => "string"
        }
        on_error => "stats_flow_get_used_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_get_used_labels.value" => "%{stats.flow.get_used}"
        }
        on_error => "stats_flow_get_used_not_found"
      }
      if ![stats_flow_get_used_not_found] and [stats][flow][get_used] != "" {
        mutate {
          replace => {
            "stats_flow_get_used_labels.key" => "stats_flow_get_used"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_get_used_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.get_used_eval" => "string"
        }
        on_error => "stats_flow_get_used_eval_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_get_used_eval_labels.value" =>
          "%{stats.flow.get_used_eval}"
        }
        on_error => "stats_flow_get_used_eval_not_found"
      }
      if ![stats_flow_get_used_eval_not_found] and
      [stats][flow][get_used_eval] != "" {
        mutate {
          replace => {
            "stats_flow_get_used_eval_labels.key" => "stats_flow_get_used_eval"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_get_used_eval_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.get_used_eval_reject" => "string"
        }
        on_error => "stats_flow_get_used_eval_reject_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_get_used_eval_reject_labels.value" =>
          "%{stats.flow.get_used_eval_reject}"
        }
        on_error => "stats_flow_get_used_eval_reject_not_found"
      }
      if ![stats_flow_get_used_eval_reject_not_found] and
      [stats][flow][get_used_eval_reject] != "" {
        mutate {
          replace => {
            "stats_flow_get_used_eval_reject_labels.key" =>
            "stats_flow_get_used_eval_reject"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_get_used_eval_reject_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.get_used_eval_busy" => "string"
        }
        on_error => "stats_flow_get_used_eval_busy_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_get_used_eval_busy_labels.value" =>
          "%{stats.flow.get_used_eval_busy}"
        }
        on_error => "stats_flow_get_used_eval_busy_not_found"
      }
      if ![stats_flow_get_used_eval_busy_not_found] and
      [stats][flow][get_used_eval_busy] != "" {
        mutate {
          replace => {
            "stats_flow_get_used_eval_busy_labels.key" =>
            "stats_flow_get_used_eval_busy"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_get_used_eval_busy_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.get_used_failed" => "string"
        }
        on_error => "stats_flow_get_used_failed_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_get_used_failed_labels.value" =>
          "%{stats.flow.get_used_failed}"
        }
        on_error => "stats_flow_get_used_failed_not_found"
      }
      if ![stats_flow_get_used_failed_not_found] and
      [stats][flow][get_used_failed] != "" {
        mutate {
          replace => {
            "stats_flow_get_used_failed_labels.key" =>
            "stats_flow_get_used_failed"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_get_used_failed_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.spare_sync_avg" => "string"
        }
        on_error => "stats_flow_wrk_spare_sync_avg_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_spare_sync_avg_labels.value" =>
          "%{stats.flow.wrk.spare_sync_avg}"
        }
        on_error => "stats_flow_wrk_spare_sync_avg_not_found"
      }
      if ![stats_flow_wrk_spare_sync_avg_not_found] and
      [stats][flow][wrk][spare_sync_avg] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_spare_sync_avg_labels.key" =>
            "stats_flow_wrk_spare_sync_avg"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_spare_sync_avg_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.spare_sync" => "string"
        }
        on_error => "stats_flow_wrk_spare_sync_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_spare_sync_labels.value" =>
          "%{stats.flow.wrk.spare_sync}"
        }
        on_error => "stats_flow_wrk_spare_sync_not_found"
      }
      if ![stats_flow_wrk_spare_sync_not_found] and
      [stats][flow][wrk][spare_sync] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_spare_sync_labels.key" =>
            "stats_flow_wrk_spare_sync"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_wrk_spare_sync_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.spare_sync_incomplete" => "string"
        }
        on_error => "stats_flow_wrk_spare_sync_incomplete_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_spare_sync_incomplete_labels.value" =>
          "%{stats.flow.wrk.spare_sync_incomplete}"
        }
        on_error => "stats_flow_wrk_spare_sync_incomplete_not_found"
      }
      if ![stats_flow_wrk_spare_sync_incomplete_not_found] and
      [stats][flow][wrk][spare_sync_incomplete] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_spare_sync_incomplete_labels.key" =>
            "stats_flow_wrk_spare_sync_incomplete"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_spare_sync_incomplete_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.spare_sync_empty" => "string"
        }
        on_error => "stats_flow_wrk_spare_sync_empty_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_spare_sync_empty_labels.value" =>
          "%{stats.flow.wrk.spare_sync_empty}"
        }
        on_error => "stats_flow_wrk_spare_sync_empty_not_found"
      }
      if ![stats_flow_wrk_spare_sync_empty_not_found] and
      [stats][flow][wrk][spare_sync_empty] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_spare_sync_empty_labels.key" =>
            "stats_flow_wrk_spare_sync_empty"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_spare_sync_empty_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.flows_evicted_needs_work" => "string"
        }
        on_error => "stats_flow_wrk_flows_evicted_needs_work_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_flows_evicted_needs_work_labels.value" =>
          "%{stats.flow.wrk.flows_evicted_needs_work}"
        }
        on_error => "stats_flow_wrk_flows_evicted_needs_work_not_found"
      }
      if ![stats_flow_wrk_flows_evicted_needs_work_not_found] and
      [stats][flow][wrk][flows_evicted_needs_work] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_flows_evicted_needs_work_labels.key" =>
            "stats_flow_wrk_flows_evicted_needs_work"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_flows_evicted_needs_work_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.flows_evicted_pkt_inject" => "string"
        }
        on_error => "stats_flow_wrk_flows_evicted_pkt_inject_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_flows_evicted_pkt_inject_labels.value" =>
          "%{stats.flow.wrk.flows_evicted_pkt_inject}"
        }
        on_error => "stats_flow_wrk_flows_evicted_pkt_inject_not_found"
      }
      if ![stats_flow_wrk_flows_evicted_pkt_inject_not_found] and
      [stats][flow][wrk][flows_evicted_pkt_inject] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_flows_evicted_pkt_inject_labels.key" =>
            "stats_flow_wrk_flows_evicted_pkt_inject"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_flows_evicted_pkt_inject_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.flows_evicted" => "string"
        }
        on_error => "stats_flow_wrk_flows_evicted_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_flows_evicted_labels.value" =>
          "%{stats.flow.wrk.flows_evicted}"
        }
        on_error => "stats_flow_wrk_flows_evicted_not_found"
      }
      if ![stats_flow_wrk_flows_evicted_not_found] and
      [stats][flow][wrk][flows_evicted] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_flows_evicted_labels.key" =>
            "stats_flow_wrk_flows_evicted"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_flows_evicted_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.wrk.flows_injected" => "string"
        }
        on_error => "stats_flow_wrk_flows_injected_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_wrk_flows_injected_labels.value" =>
          "%{stats.flow.wrk.flows_injected}"
        }
        on_error => "stats_flow_wrk_flows_injected_not_found"
      }
      if ![stats_flow_wrk_flows_injected_not_found] and
      [stats][flow][wrk][flows_injected] != "" {
        mutate {
          replace => {
            "stats_flow_wrk_flows_injected_labels.key" =>
            "stats_flow_wrk_flows_injected"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_wrk_flows_injected_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.full_hash_pass" => "string"
        }
        on_error => "stats_flow_mgr_full_hash_pass_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_full_hash_pass_labels.value" =>
          "%{stats.flow.mgr.full_hash_pass}"
        }
        on_error => "stats_flow_mgr_full_hash_pass_not_found"
      }
      if ![stats_flow_mgr_full_hash_pass_not_found] and
      [stats][flow][mgr][full_hash_pass] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_full_hash_pass_labels.key" =>
            "stats_flow_mgr_full_hash_pass"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_full_hash_pass_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.closed_pruned" => "string"
        }
        on_error => "stats_flow_mgr_closed_pruned_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_closed_pruned_labels.value" =>
          "%{stats.flow.mgr.closed_pruned}"
        }
        on_error => "stats_flow_mgr_closed_pruned_not_found"
      }
      if ![stats_flow_mgr_closed_pruned_not_found] and
      [stats][flow][mgr][closed_pruned] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_closed_pruned_labels.key" =>
            "stats_flow_mgr_closed_pruned"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_closed_pruned_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.new_pruned" => "string"
        }
        on_error => "stats_flow_mgr_new_pruned_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_new_pruned_labels.value" =>
          "%{stats.flow.mgr.new_pruned}"
        }
        on_error => "stats_flow_mgr_new_pruned_not_found"
      }
      if ![stats_flow_mgr_new_pruned_not_found] and
      [stats][flow][mgr][new_pruned] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_new_pruned_labels.key" =>
            "stats_flow_mgr_new_pruned"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_mgr_new_pruned_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.est_pruned" => "string"
        }
        on_error => "stats_flow_mgr_est_pruned_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_est_pruned_labels.value" =>
          "%{stats.flow.mgr.est_pruned}"
        }
        on_error => "stats_flow_mgr_est_pruned_not_found"
      }
      if ![stats_flow_mgr_est_pruned_not_found] and
      [stats][flow][mgr][est_pruned] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_est_pruned_labels.key" =>
            "stats_flow_mgr_est_pruned"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_mgr_est_pruned_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.bypassed_pruned" => "string"
        }
        on_error => "stats_flow_mgr_bypassed_pruned_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_bypassed_pruned_labels.value" =>
          "%{stats.flow.mgr.bypassed_pruned}"
        }
        on_error => "stats_flow_mgr_bypassed_pruned_not_found"
      }
      if ![stats_flow_mgr_bypassed_pruned_not_found] and
      [stats][flow][mgr][bypassed_pruned] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_bypassed_pruned_labels.key" =>
            "stats_flow_mgr_bypassed_pruned"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_bypassed_pruned_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.rows_maxlen" => "string"
        }
        on_error => "stats_flow_mgr_rows_maxlen_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_rows_maxlen_labels.value" =>
          "%{stats.flow.mgr.rows_maxlen}"
        }
        on_error => "stats_flow_mgr_rows_maxlen_not_found"
      }
      if ![stats_flow_mgr_rows_maxlen_not_found] and
      [stats][flow][mgr][rows_maxlen] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_rows_maxlen_labels.key" =>
            "stats_flow_mgr_rows_maxlen"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_mgr_rows_maxlen_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_checked" => "string"
        }
        on_error => "stats_flow_mgr_flows_checked_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_checked_labels.value" =>
          "%{stats.flow.mgr.flows_checked}"
        }
        on_error => "stats_flow_mgr_flows_checked_not_found"
      }
      if ![stats_flow_mgr_flows_checked_not_found] and
      [stats][flow][mgr][flows_checked] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_checked_labels.key" =>
            "stats_flow_mgr_flows_checked"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_checked_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_notimeout" => "string"
        }
        on_error => "stats_flow_mgr_flows_notimeout_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_notimeout_labels.value" =>
          "%{stats.flow.mgr.flows_notimeout}"
        }
        on_error => "stats_flow_mgr_flows_notimeout_not_found"
      }
      if ![stats_flow_mgr_flows_notimeout_not_found] and
      [stats][flow][mgr][flows_notimeout] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_notimeout_labels.key" =>
            "stats_flow_mgr_flows_notimeout"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_notimeout_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_timeout" => "string"
        }
        on_error => "stats_flow_mgr_flows_timeout_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_timeout_labels.value" =>
          "%{stats.flow.mgr.flows_timeout}"
        }
        on_error => "stats_flow_mgr_flows_timeout_not_found"
      }
      if ![stats_flow_mgr_flows_timeout_not_found] and
      [stats][flow][mgr][flows_timeout] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_timeout_labels.key" =>
            "stats_flow_mgr_flows_timeout"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_timeout_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_timeout_inuse" => "string"
        }
        on_error => "stats_flow_mgr_flows_timeout_inuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_timeout_inuse_labels.value" =>
          "%{stats.flow.mgr.flows_timeout_inuse}"
        }
        on_error => "stats_flow_mgr_flows_timeout_inuse_not_found"
      }
      if ![stats_flow_mgr_flows_timeout_inuse_not_found] and
      [stats][flow][mgr][flows_timeout_inuse] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_timeout_inuse_labels.key" =>
            "stats_flow_mgr_flows_timeout_inuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_timeout_inuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_evicted" => "string"
        }
        on_error => "stats_flow_mgr_flows_evicted_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_evicted_labels.value" =>
          "%{stats.flow.mgr.flows_evicted}"
        }
        on_error => "stats_flow_mgr_flows_evicted_not_found"
      }
      if ![stats_flow_mgr_flows_evicted_not_found] and
      [stats][flow][mgr][flows_evicted] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_evicted_labels.key" =>
            "stats_flow_mgr_flows_evicted"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_evicted_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.mgr.flows_evicted_needs_work" => "string"
        }
        on_error => "stats_flow_mgr_flows_evicted_needs_work_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_mgr_flows_evicted_needs_work_labels.value" =>
          "%{stats.flow.mgr.flows_evicted_needs_work}"
        }
        on_error => "stats_flow_mgr_flows_evicted_needs_work_not_found"
      }
      if ![stats_flow_mgr_flows_evicted_needs_work_not_found] and
      [stats][flow][mgr][flows_evicted_needs_work] != "" {
        mutate {
          replace => {
            "stats_flow_mgr_flows_evicted_needs_work_labels.key" =>
            "stats_flow_mgr_flows_evicted_needs_work"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_mgr_flows_evicted_needs_work_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.spare" => "string"
        }
        on_error => "stats_flow_spare_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_spare_labels.value" => "%{stats.flow.spare}"
        }
        on_error => "stats_flow_spare_not_found"
      }
      if ![stats_flow_spare_not_found] and [stats][flow][spare] != "" {
        mutate {
          replace => {
            "stats_flow_spare_labels.key" => "stats_flow_spare"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_spare_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.emerg_mode_entered" => "string"
        }
        on_error => "stats_flow_emerg_mode_entered_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_emerg_mode_entered_labels.value" =>
          "%{stats.flow.emerg_mode_entered}"
        }
        on_error => "stats_flow_emerg_mode_entered_not_found"
      }
      if ![stats_flow_emerg_mode_entered_not_found]
      and [stats][flow][emerg_mode_entered] != "" {
        mutate {
          replace => {
            "stats_flow_emerg_mode_entered_labels.key" =>
            "stats_flow_emerg_mode_entered"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_emerg_mode_entered_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.emerg_mode_over" => "string"
        }
        on_error => "stats_flow_emerg_mode_over_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_emerg_mode_over_labels.value" =>
          "%{stats.flow.emerg_mode_over}"
        }
        on_error => "stats_flow_emerg_mode_over_not_found"
      }
      if ![stats_flow_emerg_mode_over_not_found]
      and [stats][flow][emerg_mode_over] != "" {
        mutate {
          replace => {
            "stats_flow_emerg_mode_over_labels.key" =>
            "stats_flow_emerg_mode_over"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_emerg_mode_over_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow.memuse" => "string"
        }
        on_error => "stats_flow_memuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_memuse_labels.value" => "%{stats.flow.memuse}"
        }
        on_error => "stats_flow_memuse_not_found"
      }
      if ![stats_flow_memuse_not_found] and [stats][flow][memuse] != "" {
        mutate {
          replace => {
            "stats_flow_memuse_labels.key" => "stats_flow_memuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_memuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv4.fragments" => "string"
        }
        on_error => "stats_defrag_ipv4_fragments_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv4_fragments_labels.value" =>
          "%{stats.defrag.ipv4.fragments}"
        }
        on_error => "stats_defrag_ipv4_fragments_not_found"
      }
      if ![stats_defrag_ipv4_fragments_not_found]
      and [stats][defrag][ipv4][fragments] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv4_fragments_labels.key" =>
            "stats_defrag_ipv4_fragments"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_defrag_ipv4_fragments_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv4.reassembled" => "string"
        }
        on_error => "stats_defrag_ipv4_reassembled_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv4_reassembled_labels.value" =>
          "%{stats.defrag.ipv4.reassembled}"
        }
        on_error => "stats_defrag_ipv4_reassembled_not_found"
      }
      if ![stats_defrag_ipv4_reassembled_not_found]
      and [stats][defrag][ipv4][reassembled] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv4_reassembled_labels.key" =>
            "stats_defrag_ipv4_reassembled"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_defrag_ipv4_reassembled_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv4.timeouts" => "string"
        }
        on_error => "stats_defrag_ipv4_timeouts_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv4_timeouts_labels.value" =>
          "%{stats.defrag.ipv4.timeouts}"
        }
        on_error => "stats_defrag_ipv4_timeouts_not_found"
      }
      if ![stats_defrag_ipv4_timeouts_not_found]
      and [stats][defrag][ipv4][timeouts] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv4_timeouts_labels.key" =>
            "stats_defrag_ipv4_timeouts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_defrag_ipv4_timeouts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv6.fragments" => "string"
        }
        on_error => "stats_defrag_ipv6_fragments_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv6_fragments_labels.value" =>
          "%{stats.defrag.ipv6.fragments}"
        }
        on_error => "stats_defrag_ipv6_fragments_not_found"
      }
      if ![stats_defrag_ipv6_fragments_not_found]
      and [stats][defrag][ipv6][fragments] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv6_fragments_labels.key" =>
            "stats_defrag_ipv6_fragments"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_defrag_ipv6_fragments_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv6.reassembled" => "string"
        }
        on_error => "stats_defrag_ipv6_reassembled_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv6_reassembled_labels.value" =>
          "%{stats.defrag.ipv6.reassembled}"
        }
        on_error => "stats_defrag_ipv6_reassembled_not_found"
      }
      if ![stats_defrag_ipv6_reassembled_not_found]
      and [stats][defrag][ipv6][reassembled] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv6_reassembled_labels.key" =>
            "stats_defrag_ipv6_reassembled"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_defrag_ipv6_reassembled_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.ipv6.timeouts" => "string"
        }
        on_error => "stats_defrag_ipv6_timeouts_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_ipv6_timeouts_labels.value" =>
          "%{stats.defrag.ipv6.timeouts}"
        }
        on_error => "stats_defrag_ipv6_timeouts_not_found"
      }
      if ![stats_defrag_ipv6_timeouts_not_found]
      and [stats][defrag][ipv6][timeouts] != "" {
        mutate {
          replace => {
            "stats_defrag_ipv6_timeouts_labels.key" =>
            "stats_defrag_ipv6_timeouts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_defrag_ipv6_timeouts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.defrag.max_frag_hits" => "string"
        }
        on_error => "stats_defrag_max_frag_hits_conversion_error"
      }

      mutate {
        replace => {
          "stats_defrag_max_frag_hits_labels.value" =>
          "%{stats.defrag.max_frag_hits}"
        }
        on_error => "stats_defrag_max_frag_hits_not_found"
      }
      if ![stats_defrag_max_frag_hits_not_found]
      and [stats][defrag][max_frag_hits] != "" {
        mutate {
          replace => {
            "stats_defrag_max_frag_hits_labels.key" =>
            "stats_defrag_max_frag_hits"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_defrag_max_frag_hits_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.local_pkts" => "string"
        }
        on_error => "stats_flow_bypassed_local_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_local_pkts_labels.value" =>
          "%{stats.flow_bypassed.local_pkts}"
        }
        on_error => "stats_flow_bypassed_local_pkts_not_found"
      }
      if ![stats_flow_bypassed_local_pkts_not_found]
      and [stats][flow_bypassed][local_pkts] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_local_pkts_labels.key" =>
            "stats_flow_bypassed_local_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_bypassed_local_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.local_bytes" => "string"
        }
        on_error => "stats_flow_bypassed_local_bytes_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_local_bytes_labels.value" =>
          "%{stats.flow_bypassed.local_bytes}"
        }
        on_error => "stats_flow_bypassed_local_bytes_not_found"
      }
      if ![stats_flow_bypassed_local_bytes_not_found]
      and [stats][flow_bypassed][local_bytes] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_local_bytes_labels.key" =>
            "stats_flow_bypassed_local_bytes"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_bypassed_local_bytes_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.local_capture_pkts" => "string"
        }
        on_error => "stats_flow_bypassed_local_capture_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_local_capture_pkts_labels.value" =>
          "%{stats.flow_bypassed.local_capture_pkts}"
        }
        on_error => "stats_flow_bypassed_local_capture_pkts_not_found"
      }
      if ![stats_flow_bypassed_local_capture_pkts_not_found]
      and [stats][flow_bypassed][local_capture_pkts] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_local_capture_pkts_labels.key" =>
            "stats_flow_bypassed_local_capture_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_bypassed_local_capture_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.local_capture_bytes" => "string"
        }
        on_error => "stats_flow_bypassed_local_capture_bytes_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_local_capture_bytes_labels.value" =>
          "%{stats.flow_bypassed.local_capture_bytes}"
        }
        on_error => "stats_flow_bypassed_local_capture_bytes_not_found"
      }
      if ![stats_flow_bypassed_local_capture_bytes_not_found]
      and [stats][flow_bypassed][local_capture_bytes] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_local_capture_bytes_labels.key" =>
            "stats_flow_bypassed_local_capture_bytes"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_flow_bypassed_local_capture_bytes_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.closed" => "string"
        }
        on_error => "stats_flow_bypassed_closed_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_closed_labels.value" =>
          "%{stats.flow_bypassed.closed}"
        }
        on_error => "stats_flow_bypassed_closed_not_found"
      }
      if ![stats_flow_bypassed_closed_not_found]
      and [stats][flow_bypassed][closed] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_closed_labels.key" =>
            "stats_flow_bypassed_closed"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_bypassed_closed_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.pkts" => "string"
        }
        on_error => "stats_flow_bypassed_pkts_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_pkts_labels.value" =>
          "%{stats.flow_bypassed.pkts}"
        }
        on_error => "stats_flow_bypassed_pkts_not_found"
      }
      if ![stats_flow_bypassed_pkts_not_found]
      and [stats][flow_bypassed][pkts] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_pkts_labels.key" => "stats_flow_bypassed_pkts"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_bypassed_pkts_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.flow_bypassed.bytes" => "string"
        }
        on_error => "stats_flow_bypassed_bytes_conversion_error"
      }

      mutate {
        replace => {
          "stats_flow_bypassed_bytes_labels.value" =>
          "%{stats.flow_bypassed.bytes}"
        }
        on_error => "stats_flow_bypassed_bytes_not_found"
      }
      if ![stats_flow_bypassed_bytes_not_found]
      and [stats][flow_bypassed][bytes] != "" {
        mutate {
          replace => {
            "stats_flow_bypassed_bytes_labels.key" =>
            "stats_flow_bypassed_bytes"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_flow_bypassed_bytes_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.sessions" => "string"
        }
        on_error => "stats_tcp_sessions_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_sessions_labels.value" => "%{stats.tcp.sessions}"
        }
        on_error => "stats_tcp_sessions_not_found"
      }
      if ![stats_tcp_sessions_not_found] and [stats][tcp][sessions] != "" {
        mutate {
          replace => {
            "stats_tcp_sessions_labels.key" => "stats_tcp_sessions"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_sessions_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.ssn_memcap_drop" => "string"
        }
        on_error => "stats_tcp_ssn_memcap_drop_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_ssn_memcap_drop_labels.value" =>
          "%{stats.tcp.ssn_memcap_drop}"
        }
        on_error => "stats_tcp_ssn_memcap_drop_not_found"
      }
      if ![stats_tcp_ssn_memcap_drop_not_found]
      and [stats][tcp][ssn_memcap_drop] != "" {
        mutate {
          replace => {
            "stats_tcp_ssn_memcap_drop_labels.key" =>
            "stats_tcp_ssn_memcap_drop"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_ssn_memcap_drop_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.pseudo" => "string"
        }
        on_error => "stats_tcp_pseudo_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_pseudo_labels.value" => "%{stats.tcp.pseudo}"
        }
        on_error => "stats_tcp_pseudo_not_found"
      }
      if ![stats_tcp_pseudo_not_found] and [stats][tcp][pseudo] != "" {
        mutate {
          replace => {
            "stats_tcp_pseudo_labels.key" => "stats_tcp_pseudo"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_pseudo_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.pseudo_failed" => "string"
        }
        on_error => "stats_tcp_pseudo_failed_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_pseudo_failed_labels.value" => "%{stats.tcp.pseudo_failed}"
        }
        on_error => "stats_tcp_pseudo_failed_not_found"
      }
      if ![stats_tcp_pseudo_failed_not_found]
      and [stats][tcp][pseudo_failed] != "" {
        mutate {
          replace => {
            "stats_tcp_pseudo_failed_labels.key" => "stats_tcp_pseudo_failed"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_pseudo_failed_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.invalid_checksum" => "string"
        }
        on_error => "stats_tcp_invalid_checksum_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_invalid_checksum_labels.value" =>
          "%{stats.tcp.invalid_checksum}"
        }
        on_error => "stats_tcp_invalid_checksum_not_found"
      }
      if ![stats_tcp_invalid_checksum_not_found]
      and [stats][tcp][invalid_checksum] != "" {
        mutate {
          replace => {
            "stats_tcp_invalid_checksum_labels.key" =>
            "stats_tcp_invalid_checksum"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_invalid_checksum_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.no_flow" => "string"
        }
        on_error => "stats_tcp_no_flow_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_no_flow_labels.value" => "%{stats.tcp.no_flow}"
        }
        on_error => "stats_tcp_no_flow_not_found"
      }
      if ![stats_tcp_no_flow_not_found] and [stats][tcp][no_flow] != "" {
        mutate {
          replace => {
            "stats_tcp_no_flow_labels.key" => "stats_tcp_no_flow"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_no_flow_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.syn" => "string"
        }
        on_error => "stats_tcp_syn_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_syn_labels.value" => "%{stats.tcp.syn}"
        }
        on_error => "stats_tcp_syn_not_found"
      }
      if ![stats_tcp_syn_not_found] and [stats][tcp][syn] != "" {
        mutate {
          replace => {
            "stats_tcp_syn_labels.key" => "stats_tcp_syn"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_syn_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.synack" => "string"
        }
        on_error => "stats_tcp_synack_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_synack_labels.value" => "%{stats.tcp.synack}"
        }
        on_error => "stats_tcp_synack_not_found"
      }
      if ![stats_tcp_synack_not_found] and [stats][tcp][synack] != "" {
        mutate {
          replace => {
            "stats_tcp_synack_labels.key" => "stats_tcp_synack"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_synack_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.rst" => "string"
        }
        on_error => "stats_tcp_rst_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_rst_labels.value" => "%{stats.tcp.rst}"
        }
        on_error => "stats_tcp_rst_not_found"
      }
      if ![stats_tcp_rst_not_found] and [stats][tcp][rst] != "" {
        mutate {
          replace => {
            "stats_tcp_rst_labels.key" => "stats_tcp_rst"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_rst_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.midstream_pickups" => "string"
        }
        on_error => "stats_tcp_midstream_pickups_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_midstream_pickups_labels.value" =>
          "%{stats.tcp.midstream_pickups}"
        }
        on_error => "stats_tcp_midstream_pickups_not_found"
      }
      if ![stats_tcp_midstream_pickups_not_found]
      and [stats][tcp][midstream_pickups] != "" {
        mutate {
          replace => {
            "stats_tcp_midstream_pickups_labels.key" =>
            "stats_tcp_midstream_pickups"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_midstream_pickups_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.pkt_on_wrong_thread" => "string"
        }
        on_error => "stats_tcp_pkt_on_wrong_thread_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_pkt_on_wrong_thread_labels.value" =>
          "%{stats.tcp.pkt_on_wrong_thread}"
        }
        on_error => "stats_tcp_pkt_on_wrong_thread_not_found"
      }
      if ![stats_tcp_pkt_on_wrong_thread_not_found]
      and [stats][tcp][pkt_on_wrong_thread] != "" {
        mutate {
          replace => {
            "stats_tcp_pkt_on_wrong_thread_labels.key" =>
            "stats_tcp_pkt_on_wrong_thread"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_pkt_on_wrong_thread_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.segment_memcap_drop" => "string"
        }
        on_error => "stats_tcp_segment_memcap_drop_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_segment_memcap_drop_labels.value" =>
          "%{stats.tcp.segment_memcap_drop}"
        }
        on_error => "stats_tcp_segment_memcap_drop_not_found"
      }
      if ![stats_tcp_segment_memcap_drop_not_found]
      and [stats][tcp][segment_memcap_drop] != "" {
        mutate {
          replace => {
            "stats_tcp_segment_memcap_drop_labels.key" =>
            "stats_tcp_segment_memcap_drop"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_segment_memcap_drop_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.stream_depth_reached" => "string"
        }
        on_error => "stats_tcp_stream_depth_reached_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_stream_depth_reached_labels.value" =>
          "%{stats.tcp.stream_depth_reached}"
        }
        on_error => "stats_tcp_stream_depth_reached_not_found"
      }
      if ![stats_tcp_stream_depth_reached_not_found]
      and [stats][tcp][stream_depth_reached] != "" {
        mutate {
          replace => {
            "stats_tcp_stream_depth_reached_labels.key" =>
            "stats_tcp_stream_depth_reached"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_stream_depth_reached_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.reassembly_gap" => "string"
        }
        on_error => "stats_tcp_reassembly_gap_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_reassembly_gap_labels.value" =>
          "%{stats.tcp.reassembly_gap}"
        }
        on_error => "stats_tcp_reassembly_gap_not_found"
      }
      if ![stats_tcp_reassembly_gap_not_found]
      and [stats][tcp][reassembly_gap] != "" {
        mutate {
          replace => {
            "stats_tcp_reassembly_gap_labels.key" => "stats_tcp_reassembly_gap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_reassembly_gap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.overlap" => "string"
        }
        on_error => "stats_tcp_overlap_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_overlap_labels.value" => "%{stats.tcp.overlap}"
        }
        on_error => "stats_tcp_overlap_not_found"
      }
      if ![stats_tcp_overlap_not_found] and [stats][tcp][overlap] != "" {
        mutate {
          replace => {
            "stats_tcp_overlap_labels.key" => "stats_tcp_overlap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_overlap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.overlap_diff_data" => "string"
        }
        on_error => "stats_tcp_overlap_diff_data_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_overlap_diff_data_labels.value" => "%{stats.tcp.overlap_diff_data}"
        }
        on_error =>
          "stats_tcp_overlap_diff_data_not_found"
      }
      if ![stats_tcp_overlap_diff_data_not_found]
      and [stats][tcp][overlap_diff_data] != "" {
        mutate {
          replace => {
            "stats_tcp_overlap_diff_data_labels.key" =>
            "stats_tcp_overlap_diff_data"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_overlap_diff_data_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.insert_data_normal_fail" => "string"
        }
        on_error => "stats_tcp_insert_data_normal_fail_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_insert_data_normal_fail_labels.value" =>
          "%{stats.tcp.insert_data_normal_fail}"
        }
        on_error => "stats_tcp_insert_data_normal_fail_not_found"
      }
      if ![stats_tcp_insert_data_normal_fail_not_found]
      and [stats][tcp][insert_data_normal_fail] != "" {
        mutate {
          replace => {
            "stats_tcp_insert_data_normal_fail_labels.key" =>
            "stats_tcp_insert_data_normal_fail"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_insert_data_normal_fail_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.insert_data_overlap_fail" => "string"
        }
        on_error => "stats_tcp_insert_data_overlap_fail_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_insert_data_overlap_fail_labels.value" =>
          "%{stats.tcp.insert_data_overlap_fail}"
        }
        on_error => "stats_tcp_insert_data_overlap_fail_not_found"
      }
      if ![stats_tcp_insert_data_overlap_fail_not_found]
      and [stats][tcp][insert_data_overlap_fail] != "" {
        mutate {
          replace => {
            "stats_tcp_insert_data_overlap_fail_labels.key" =>
            "stats_tcp_insert_data_overlap_fail"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_insert_data_overlap_fail_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.insert_list_fail" => "string"
        }
        on_error => "stats_tcp_insert_list_fail_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_insert_list_fail_labels.value" =>
          "%{stats.tcp.insert_list_fail}"
        }
        on_error => "stats_tcp_insert_list_fail_not_found"
      }
      if ![stats_tcp_insert_list_fail_not_found]
      and [stats][tcp][insert_list_fail] != "" {
        mutate {
          replace => {
            "stats_tcp_insert_list_fail_labels.key" =>
            "stats_tcp_insert_list_fail"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_insert_list_fail_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.memuse" => "string"
        }
        on_error => "stats_tcp_memuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_memuse_labels.value" => "%{stats.tcp.memuse}"
        }
        on_error => "stats_tcp_memuse_not_found"
      }
      if ![stats_tcp_memuse_not_found] and [stats][tcp][memuse] != "" {
        mutate {
          replace => {
            "stats_tcp_memuse_labels.key" => "stats_tcp_memuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_tcp_memuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.tcp.reassembly_memuse" => "string"
        }
        on_error => "stats_tcp_reassembly_memuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_tcp_reassembly_memuse_labels.value" =>
          "%{stats.tcp.reassembly_memuse}"
        }
        on_error => "stats_tcp_reassembly_memuse_not_found"
      }
      if ![stats_tcp_reassembly_memuse_not_found]
      and [stats][tcp][reassembly_memuse] != "" {
        mutate {
          replace => {
            "stats_tcp_reassembly_memuse_labels.key" =>
            "stats_tcp_reassembly_memuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_tcp_reassembly_memuse_labels"
          }
        }
      }

      for engine in stats.detect.engines {

        mutate {
          replace => {
            "stats_detect_engines_id_labels" => ""
            "stats_detect_engines_last_reload_labels" => ""
            "stats_detect_engines_rules_loaded_labels" => ""
            "stats_detect_engines_rules_failed_labels" => ""
          }
        }
        mutate {
          convert => {
            "engine.id" => "string"
          }
          on_error => "stats_detect_engines_id_conversion_error"
        }

        mutate {
          replace => {
            "stats_detect_engines_id_labels.value" => "%{engine.id}"
          }
          on_error => "stats_detect_engines_id_not_found"
        }
        if ![stats_detect_engines_id_not_found] and [engine][id] != "" {
          mutate {
            replace => {
              "stats_detect_engines_id_labels.key" => "stats_detect_engines_id"
            }
          }
          mutate {
            merge => {
              "suricata_stats_about.labels" => "stats_detect_engines_id_labels"
            }
          }
        }

        mutate {
          convert => {
            "engine.last_reload" => "string"
          }
          on_error => "stats_detect_engines_last_reload_conversion_error"
        }

        mutate {
          replace => {
            "stats_detect_engines_last_reload_labels.value" =>
          "%{engine.last_reload}"
          }
          on_error => "stats_detect_engines_last_reload_not_found"
        }
        if ![stats_detect_engines_last_reload_not_found]
      and [engine][last_reload] != "" {
          mutate {
            replace => {
              "stats_detect_engines_last_reload_labels.key" =>
            "stats_detect_engines_last_reload"
            }
          }
          mutate {
            merge => {
              "suricata_stats_about.labels" =>
            "stats_detect_engines_last_reload_labels"
            }
          }
        }

        mutate {
          convert => {
            "engine.rules_loaded" => "string"
          }
          on_error => "stats_detect_engines_rules_loaded_conversion_error"
        }

        mutate {
          replace => {
            "stats_detect_engines_rules_loaded_labels.value" =>
          "%{engine.rules_loaded}"
          }
          on_error => "stats_detect_engines_rules_loaded_not_found"
        }
        if ![stats_detect_engines_rules_loaded_not_found]
      and [engine][rules_loaded] != "" {
          mutate {
            replace => {
              "stats_detect_engines_rules_loaded_labels.key" =>
            "stats_detect_engines_rules_loaded"
            }
          }
          mutate {
            merge => {
              "suricata_stats_about.labels" =>
            "stats_detect_engines_rules_loaded_labels"
            }
          }
        }

        mutate {
          convert => {
            "engine.rules_failed" => "string"
          }
          on_error => "stats_detect_engines_rules_failed_conversion_error"
        }

        mutate {
          replace => {
            "stats_detect_engines_rules_failed_labels.value" =>
          "%{engine.rules_failed}"
          }
          on_error => "stats_detect_engines_rules_failed_not_found"
        }
        if ![stats_detect_engines_rules_failed_not_found]
      and [engine][rules_failed] != "" {
          mutate {
            replace => {
              "stats_detect_engines_rules_failed_labels.key" =>
            "stats_detect_engines_rules_failed"
            }
          }
          mutate {
            merge => {
              "suricata_stats_about.labels" =>
            "stats_detect_engines_rules_failed_labels"
            }
          }
        }
      }

      mutate {
        convert => {
          "stats.detect.alert" => "string"
        }
        on_error => "stats_detect_alert_conversion_error"
      }

      mutate {
        replace => {
          "stats_detect_alert_labels.value" => "%{stats.detect.alert}"
        }
        on_error => "stats_detect_alert_not_found"
      }
      if ![stats_detect_alert_not_found]
      and [stats][detect][alert] != "" {
        mutate {
          replace => {
            "stats_detect_alert_labels.key" => "stats_detect_alert"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_detect_alert_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.detect.alert_queue_overflow" => "string"
        }
        on_error => "stats_detect_alert_queue_overflow_conversion_error"
      }

      mutate {
        replace => {
          "stats_detect_alert_queue_overflow_labels.value" =>
          "%{stats.detect.alert_queue_overflow}"
        }
        on_error => "stats_detect_alert_queue_overflow_not_found"
      }
      if ![stats_detect_alert_queue_overflow_not_found]
      and [stats][detect][alert_queue_overflow] != "" {
        mutate {
          replace => {
            "stats_detect_alert_queue_overflow_labels.key" =>
            "stats_detect_alert_queue_overflow"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_detect_alert_queue_overflow_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.detect.alerts_suppressed" => "string"
        }
        on_error => "stats_detect_alerts_suppressed_conversion_error"
      }

      mutate {
        replace => {
          "stats_detect_alerts_suppressed_labels.value" =>
          "%{stats.detect.alerts_suppressed}"
        }
        on_error => "stats_detect_alerts_suppressed_not_found"
      }
      if ![stats_detect_alerts_suppressed_not_found]
      and [stats][detect][alerts_suppressed] != "" {
        mutate {
          replace => {
            "stats_detect_alerts_suppressed_labels.key" =>
            "stats_detect_alerts_suppressed"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_detect_alerts_suppressed_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.http" => "string"
        }
        on_error => "stats_app_layer_flow_http_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_http_labels.value" =>
          "%{stats.app_layer.flow.http}"
        }
        on_error => "stats_app_layer_flow_http_not_found"
      }
      if ![stats_app_layer_flow_http_not_found]
      and [stats][app_layer][flow][http] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_http_labels.key" =>
            "stats_app_layer_flow_http"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_http_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.ftp" => "string"
        }
        on_error => "stats_app_layer_flow_ftp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_ftp_labels.value" =>
          "%{stats.app_layer.flow.ftp}"
        }
        on_error => "stats_app_layer_flow_ftp_not_found"
      }
      if ![stats_app_layer_flow_ftp_not_found]
      and [stats][app_layer][flow][ftp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_ftp_labels.key" =>
            "stats_app_layer_flow_ftp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_ftp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.smtp" => "string"
        }
        on_error => "stats_app_layer_flow_smtp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_smtp_labels.value" =>
          "%{stats.app_layer.flow.smtp}"
        }
        on_error => "stats_app_layer_flow_smtp_not_found"
      }
      if ![stats_app_layer_flow_smtp_not_found]
      and [stats][app_layer][flow][smtp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_smtp_labels.key" =>
            "stats_app_layer_flow_smtp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_smtp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.tls" => "string"
        }
        on_error => "stats_app_layer_flow_tls_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_tls_labels.value" =>
          "%{stats.app_layer.flow.tls}"
        }
        on_error => "stats_app_layer_flow_tls_not_found"
      }
      if ![stats_app_layer_flow_tls_not_found]
      and [stats][app_layer][flow][tls] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_tls_labels.key" => "stats_app_layer_flow_tls"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_tls_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.ssh" => "string"
        }
        on_error => "stats_app_layer_flow_ssh_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_ssh_labels.value" =>
          "%{stats.app_layer.flow.ssh}"
        }
        on_error => "stats_app_layer_flow_ssh_not_found"
      }
      if ![stats_app_layer_flow_ssh_not_found]
      and [stats][app_layer][flow][ssh] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_ssh_labels.key" => "stats_app_layer_flow_ssh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_ssh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.imap" => "string"
        }
        on_error => "stats_app_layer_flow_imap_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_imap_labels.value" =>
          "%{stats.app_layer.flow.imap}"
        }
        on_error => "stats_app_layer_flow_imap_not_found"
      }
      if ![stats_app_layer_flow_imap_not_found]
      and [stats][app_layer][flow][imap] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_imap_labels.key" =>
            "stats_app_layer_flow_imap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_imap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.smb" => "string"
        }
        on_error => "stats_app_layer_flow_smb_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_smb_labels.value" =>
          "%{stats.app_layer.flow.smb}"
        }
        on_error => "stats_app_layer_flow_smb_not_found"
      }
      if ![stats_app_layer_flow_smb_not_found]
      and [stats][app_layer][flow][smb] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_smb_labels.key" => "stats_app_layer_flow_smb"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_smb_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.dcerpc_tcp" => "string"
        }
        on_error => "stats_app_layer_flow_dcerpc_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_dcerpc_tcp_labels.value" =>
          "%{stats.app_layer.flow.dcerpc_tcp}"
        }
        on_error => "stats_app_layer_flow_dcerpc_tcp_not_found"
      }
      if ![stats_app_layer_flow_dcerpc_tcp_not_found]
      and [stats][app_layer][flow][dcerpc_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_dcerpc_tcp_labels.key" =>
            "stats_app_layer_flow_dcerpc_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_dcerpc_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.dns_tcp" => "string"
        }
        on_error => "stats_app_layer_flow_dns_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_dns_tcp_labels.value" =>
          "%{stats.app_layer.flow.dns_tcp}"
        }
        on_error => "stats_app_layer_flow_dns_tcp_not_found"
      }
      if ![stats_app_layer_flow_dns_tcp_not_found]
      and [stats][app_layer][flow][dns_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_dns_tcp_labels.key" =>
            "stats_app_layer_flow_dns_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_dns_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.nfs_tcp" => "string"
        }
        on_error => "stats_app_layer_flow_nfs_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_nfs_tcp_labels.value" =>
          "%{stats.app_layer.flow.nfs_tcp}"
        }
        on_error => "stats_app_layer_flow_nfs_tcp_not_found"
      }
      if ![stats_app_layer_flow_nfs_tcp_not_found]
      and [stats][app_layer][flow][nfs_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_nfs_tcp_labels.key" =>
            "stats_app_layer_flow_nfs_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_nfs_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.ntp" => "string"
        }
        on_error => "stats_app_layer_flow_ntp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_ntp_labels.value" =>
          "%{stats.app_layer.flow.ntp}"
        }
        on_error => "stats_app_layer_flow_ntp_not_found"
      }
      if ![stats_app_layer_flow_ntp_not_found]
      and [stats][app_layer][flow][ntp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_ntp_labels.key" => "stats_app_layer_flow_ntp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_ntp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.ftp-data" => "string"
        }
        on_error => "stats_app_layer_flow_ftp-data_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_ftp-data_labels.value" =>
          "%{stats.app_layer.flow.ftp-data}"
        }
        on_error => "stats_app_layer_flow_ftp-data_not_found"
      }
      if ![stats_app_layer_flow_ftp-data_not_found]
      and [stats][app_layer][flow][ftp-data] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_ftp-data_labels.key" =>
            "stats_app_layer_flow_ftp-data"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_ftp-data_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.tftp" => "string"
        }
        on_error => "stats_app_layer_flow_tftp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_tftp_labels.value" =>
          "%{stats.app_layer.flow.tftp}"
        }
        on_error => "stats_app_layer_flow_tftp_not_found"
      }
      if ![stats_app_layer_flow_tftp_not_found]
      and [stats][app_layer][flow][tftp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_tftp_labels.key" =>
            "stats_app_layer_flow_tftp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_tftp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.ikev2" => "string"
        }
        on_error => "stats_app_layer_flow_ikev2_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_ikev2_labels.value" =>
          "%{stats.app_layer.flow.ikev2}"
        }
        on_error => "stats_app_layer_flow_ikev2_not_found"
      }
      if ![stats_app_layer_flow_ikev2_not_found]
      and [stats][app_layer][flow][ikev2] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_ikev2_labels.key" =>
            "stats_app_layer_flow_ikev2"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_ikev2_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.krb5_tcp" => "string"
        }
        on_error => "stats_app_layer_flow_krb5_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_krb5_tcp_labels.value" =>
          "%{stats.app_layer.flow.krb5_tcp}"
        }
        on_error => "stats_app_layer_flow_krb5_tcp_not_found"
      }
      if ![stats_app_layer_flow_krb5_tcp_not_found]
      and [stats][app_layer][flow][krb5_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_krb5_tcp_labels.key" =>
            "stats_app_layer_flow_krb5_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_krb5_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.dhcp" => "string"
        }
        on_error => "stats_app_layer_flow_dhcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_dhcp_labels.value" =>
          "%{stats.app_layer.flow.dhcp}"
        }
        on_error => "stats_app_layer_flow_dhcp_not_found"
      }
      if ![stats_app_layer_flow_dhcp_not_found]
      and [stats][app_layer][flow][dhcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_dhcp_labels.key" =>
            "stats_app_layer_flow_dhcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_dhcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.rfb" => "string"
        }
        on_error => "stats_app_layer_flow_rfb_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_rfb_labels.value" =>
          "%{stats.app_layer.flow.rfb}"
        }
        on_error => "stats_app_layer_flow_rfb_not_found"
      }
      if ![stats_app_layer_flow_rfb_not_found]
      and [stats][app_layer][flow][rfb] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_rfb_labels.key" => "stats_app_layer_flow_rfb"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_rfb_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.rdp" => "string"
        }
        on_error => "stats_app_layer_flow_rdp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_rdp_labels.value" =>
          "%{stats.app_layer.flow.rdp}"
        }
        on_error => "stats_app_layer_flow_rdp_not_found"
      }
      if ![stats_app_layer_flow_rdp_not_found]
      and [stats][app_layer][flow][rdp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_rdp_labels.key" => "stats_app_layer_flow_rdp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_flow_rdp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.failed_tcp" => "string"
        }
        on_error => "stats_app_layer_flow_failed_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_failed_tcp_labels.value" =>
          "%{stats.app_layer.flow.failed_tcp}"
        }
        on_error => "stats_app_layer_flow_failed_tcp_not_found"
      }
      if ![stats_app_layer_flow_failed_tcp_not_found]
      and [stats][app_layer][flow][failed_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_failed_tcp_labels.key" =>
            "stats_app_layer_flow_failed_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_failed_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.dcerpc_udp" => "string"
        }
        on_error => "stats_app_layer_flow_dcerpc_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_dcerpc_udp_labels.value" =>
          "%{stats.app_layer.flow.dcerpc_udp}"
        }
        on_error => "stats_app_layer_flow_dcerpc_udp_not_found"
      }
      if ![stats_app_layer_flow_dcerpc_udp_not_found]
      and [stats][app_layer][flow][dcerpc_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_dcerpc_udp_labels.key" =>
            "stats_app_layer_flow_dcerpc_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_dcerpc_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.dns_udp" => "string"
        }
        on_error => "stats_app_layer_flow_dns_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_dns_udp_labels.value" =>
          "%{stats.app_layer.flow.dns_udp}"
        }
        on_error => "stats_app_layer_flow_dns_udp_not_found"
      }
      if ![stats_app_layer_flow_dns_udp_not_found]
      and [stats][app_layer][flow][dns_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_dns_udp_labels.key" =>
            "stats_app_layer_flow_dns_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_dns_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.nfs_udp" => "string"
        }
        on_error => "stats_app_layer_flow_nfs_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_nfs_udp_labels.value" =>
          "%{stats.app_layer.flow.nfs_udp}"
        }
        on_error => "stats_app_layer_flow_nfs_udp_not_found"
      }
      if ![stats_app_layer_flow_nfs_udp_not_found]
      and [stats][app_layer][flow][nfs_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_nfs_udp_labels.key" =>
            "stats_app_layer_flow_nfs_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_nfs_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.krb5_udp" => "string"
        }
        on_error => "stats_app_layer_flow_krb5_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_krb5_udp_labels.value" =>
          "%{stats.app_layer.flow.krb5_udp}"
        }
        on_error => "stats_app_layer_flow_krb5_udp_not_found"
      }
      if ![stats_app_layer_flow_krb5_udp_not_found]
      and [stats][app_layer][flow][krb5_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_krb5_udp_labels.key" =>
            "stats_app_layer_flow_krb5_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_krb5_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.flow.failed_udp" => "string"
        }
        on_error => "stats_app_layer_flow_failed_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_flow_failed_udp_labels.value" =>
          "%{stats.app_layer.flow.failed_udp}"
        }
        on_error => "stats_app_layer_flow_failed_udp_not_found"
      }
      if ![stats_app_layer_flow_failed_udp_not_found]
      and [stats][app_layer][flow][failed_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_flow_failed_udp_labels.key" =>
            "stats_app_layer_flow_failed_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_flow_failed_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.http" => "string"
        }
        on_error => "stats_app_layer_tx_http_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_http_labels.value" => "%{stats.app_layer.tx.http}"
        }
        on_error => "stats_app_layer_tx_http_not_found"
      }
      if ![stats_app_layer_tx_http_not_found]
      and [stats][app_layer][tx][http] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_http_labels.key" => "stats_app_layer_tx_http"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_http_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.ftp" => "string"
        }
        on_error => "stats_app_layer_tx_ftp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_ftp_labels.value" => "%{stats.app_layer.tx.ftp}"
        }
        on_error => "stats_app_layer_tx_ftp_not_found"
      }
      if ![stats_app_layer_tx_ftp_not_found]
      and [stats][app_layer][tx][ftp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_ftp_labels.key" => "stats_app_layer_tx_ftp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_ftp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.smtp" => "string"
        }
        on_error => "stats_app_layer_tx_smtp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_smtp_labels.value" => "%{stats.app_layer.tx.smtp}"
        }
        on_error => "stats_app_layer_tx_smtp_not_found"
      }
      if ![stats_app_layer_tx_smtp_not_found]
      and [stats][app_layer][tx][smtp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_smtp_labels.key" => "stats_app_layer_tx_smtp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_smtp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.tls" => "string"
        }
        on_error => "stats_app_layer_tx_tls_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_tls_labels.value" => "%{stats.app_layer.tx.tls}"
        }
        on_error => "stats_app_layer_tx_tls_not_found"
      }
      if ![stats_app_layer_tx_tls_not_found]
      and [stats][app_layer][tx][tls] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_tls_labels.key" => "stats_app_layer_tx_tls"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_tls_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.ssh" => "string"
        }
        on_error => "stats_app_layer_tx_ssh_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_ssh_labels.value" => "%{stats.app_layer.tx.ssh}"
        }
        on_error => "stats_app_layer_tx_ssh_not_found"
      }
      if ![stats_app_layer_tx_ssh_not_found]
      and [stats][app_layer][tx][ssh] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_ssh_labels.key" => "stats_app_layer_tx_ssh"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_ssh_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.imap" => "string"
        }
        on_error => "stats_app_layer_tx_imap_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_imap_labels.value" => "%{stats.app_layer.tx.imap}"
        }
        on_error => "stats_app_layer_tx_imap_not_found"
      }
      if ![stats_app_layer_tx_imap_not_found]
      and [stats][app_layer][tx][imap] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_imap_labels.key" => "stats_app_layer_tx_imap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_imap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.smb" => "string"
        }
        on_error => "stats_app_layer_tx_smb_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_smb_labels.value" => "%{stats.app_layer.tx.smb}"
        }
        on_error => "stats_app_layer_tx_smb_not_found"
      }
      if ![stats_app_layer_tx_smb_not_found]
      and [stats][app_layer][tx][smb] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_smb_labels.key" => "stats_app_layer_tx_smb"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_smb_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.dcerpc_tcp" => "string"
        }
        on_error => "stats_app_layer_tx_dcerpc_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_dcerpc_tcp_labels.value" =>
          "%{stats.app_layer.tx.dcerpc_tcp}"
        }
        on_error => "stats_app_layer_tx_dcerpc_tcp_not_found"
      }
      if ![stats_app_layer_tx_dcerpc_tcp_not_found]
      and [stats][app_layer][tx][dcerpc_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_dcerpc_tcp_labels.key" =>
            "stats_app_layer_tx_dcerpc_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_dcerpc_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.dns_tcp" => "string"
        }
        on_error => "stats_app_layer_tx_dns_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_dns_tcp_labels.value" =>
          "%{stats.app_layer.tx.dns_tcp}"
        }
        on_error => "stats_app_layer_tx_dns_tcp_not_found"
      }
      if ![stats_app_layer_tx_dns_tcp_not_found]
      and [stats][app_layer][tx][dns_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_dns_tcp_labels.key" =>
            "stats_app_layer_tx_dns_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_dns_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.nfs_tcp" => "string"
        }
        on_error => "stats_app_layer_tx_nfs_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_nfs_tcp_labels.value" =>
          "%{stats.app_layer.tx.nfs_tcp}"
        }
        on_error => "stats_app_layer_tx_nfs_tcp_not_found"
      }
      if ![stats_app_layer_tx_nfs_tcp_not_found]
      and [stats][app_layer][tx][nfs_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_nfs_tcp_labels.key" =>
            "stats_app_layer_tx_nfs_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_nfs_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.ntp" => "string"
        }
        on_error => "stats_app_layer_tx_ntp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_ntp_labels.value" => "%{stats.app_layer.tx.ntp}"
        }
        on_error => "stats_app_layer_tx_ntp_not_found"
      }
      if ![stats_app_layer_tx_ntp_not_found]
      and [stats][app_layer][tx][ntp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_ntp_labels.key" => "stats_app_layer_tx_ntp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_ntp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.ftp-data" => "string"
        }
        on_error => "stats_app_layer_tx_ftp-data_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_ftp-data_labels.value" =>
          "%{stats.app_layer.tx.ftp-data}"
        }
        on_error => "stats_app_layer_tx_ftp-data_not_found"
      }
      if ![stats_app_layer_tx_ftp-data_not_found]
      and [stats][app_layer][tx][ftp-data] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_ftp-data_labels.key" =>
            "stats_app_layer_tx_ftp-data"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_ftp-data_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.tftp" => "string"
        }
        on_error => "stats_app_layer_tx_tftp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_tftp_labels.value" => "%{stats.app_layer.tx.tftp}"
        }
        on_error => "stats_app_layer_tx_tftp_not_found"
      }
      if ![stats_app_layer_tx_tftp_not_found]
      and [stats][app_layer][tx][tftp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_tftp_labels.key" => "stats_app_layer_tx_tftp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_tftp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.ikev2" => "string"
        }
        on_error => "stats_app_layer_tx_ikev2_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_ikev2_labels.value" =>
          "%{stats.app_layer.tx.ikev2}"
        }
        on_error => "stats_app_layer_tx_ikev2_not_found"
      }
      if ![stats_app_layer_tx_ikev2_not_found]
      and [stats][app_layer][tx][ikev2] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_ikev2_labels.key" => "stats_app_layer_tx_ikev2"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_ikev2_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.krb5_tcp" => "string"
        }
        on_error => "stats_app_layer_tx_krb5_tcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_krb5_tcp_labels.value" =>
          "%{stats.app_layer.tx.krb5_tcp}"
        }
        on_error => "stats_app_layer_tx_krb5_tcp_not_found"
      }
      if ![stats_app_layer_tx_krb5_tcp_not_found]
      and [stats][app_layer][tx][krb5_tcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_krb5_tcp_labels.key" =>
            "stats_app_layer_tx_krb5_tcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_krb5_tcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.dhcp" => "string"
        }
        on_error => "stats_app_layer_tx_dhcp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_dhcp_labels.value" => "%{stats.app_layer.tx.dhcp}"
        }
        on_error => "stats_app_layer_tx_dhcp_not_found"
      }
      if ![stats_app_layer_tx_dhcp_not_found]
      and [stats][app_layer][tx][dhcp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_dhcp_labels.key" => "stats_app_layer_tx_dhcp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_dhcp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.rfb" => "string"
        }
        on_error => "stats_app_layer_tx_rfb_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_rfb_labels.value" => "%{stats.app_layer.tx.rfb}"
        }
        on_error => "stats_app_layer_tx_rfb_not_found"
      }
      if ![stats_app_layer_tx_rfb_not_found]
      and [stats][app_layer][tx][rfb] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_rfb_labels.key" => "stats_app_layer_tx_rfb"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_rfb_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.rdp" => "string"
        }
        on_error => "stats_app_layer_tx_rdp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_rdp_labels.value" => "%{stats.app_layer.tx.rdp}"
        }
        on_error => "stats_app_layer_tx_rdp_not_found"
      }
      if ![stats_app_layer_tx_rdp_not_found]
      and [stats][app_layer][tx][rdp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_rdp_labels.key" => "stats_app_layer_tx_rdp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_rdp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.dcerpc_udp" => "string"
        }
        on_error => "stats_app_layer_tx_dcerpc_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_dcerpc_udp_labels.value" =>
          "%{stats.app_layer.tx.dcerpc_udp}"
        }
        on_error => "stats_app_layer_tx_dcerpc_udp_not_found"
      }
      if ![stats_app_layer_tx_dcerpc_udp_not_found]
      and [stats][app_layer][tx][dcerpc_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_dcerpc_udp_labels.key" =>
            "stats_app_layer_tx_dcerpc_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_dcerpc_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.dns_udp" => "string"
        }
        on_error => "stats_app_layer_tx_dns_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_dns_udp_labels.value" =>
          "%{stats.app_layer.tx.dns_udp}"
        }
        on_error => "stats_app_layer_tx_dns_udp_not_found"
      }
      if ![stats_app_layer_tx_dns_udp_not_found]
      and [stats][app_layer][tx][dns_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_dns_udp_labels.key" =>
            "stats_app_layer_tx_dns_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_dns_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.nfs_udp" => "string"
        }
        on_error => "stats_app_layer_tx_nfs_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_nfs_udp_labels.value" =>
          "%{stats.app_layer.tx.nfs_udp}"
        }
        on_error => "stats_app_layer_tx_nfs_udp_not_found"
      }
      if ![stats_app_layer_tx_nfs_udp_not_found]
      and [stats][app_layer][tx][nfs_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_nfs_udp_labels.key" =>
            "stats_app_layer_tx_nfs_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_app_layer_tx_nfs_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.tx.krb5_udp" => "string"
        }
        on_error => "stats_app_layer_tx_krb5_udp_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_tx_krb5_udp_labels.value" =>
          "%{stats.app_layer.tx.krb5_udp}"
        }
        on_error => "stats_app_layer_tx_krb5_udp_not_found"
      }
      if ![stats_app_layer_tx_krb5_udp_not_found]
      and [stats][app_layer][tx][krb5_udp] != "" {
        mutate {
          replace => {
            "stats_app_layer_tx_krb5_udp_labels.key" =>
            "stats_app_layer_tx_krb5_udp"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_tx_krb5_udp_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.app_layer.expectations" => "string"
        }
        on_error => "stats_app_layer_expectations_conversion_error"
      }

      mutate {
        replace => {
          "stats_app_layer_expectations_labels.value" =>
          "%{stats.app_layer.expectations}"
        }
        on_error => "stats_app_layer_expectations_not_found"
      }
      if ![stats_app_layer_expectations_not_found]
      and [stats][app_layer][expectations] != "" {
        mutate {
          replace => {
            "stats_app_layer_expectations_labels.key" =>
            "stats_app_layer_expectations"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" =>
            "stats_app_layer_expectations_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.http.memuse" => "string"
        }
        on_error => "stats_http_memuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_http_memuse_labels.value" => "%{stats.http.memuse}"
        }
        on_error => "stats_http_memuse_not_found"
      }
      if ![stats_http_memuse_not_found] and [stats][http][memuse] != "" {
        mutate {
          replace => {
            "stats_http_memuse_labels.key" => "stats_http_memuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_http_memuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.http.memcap" => "string"
        }
        on_error => "stats_http_memcap_conversion_error"
      }

      mutate {
        replace => {
          "stats_http_memcap_labels.value" => "%{stats.http.memcap}"
        }
        on_error => "stats_http_memcap_not_found"
      }
      if ![stats_http_memcap_not_found] and [stats][http][memcap] != "" {
        mutate {
          replace => {
            "stats_http_memcap_labels.key" => "stats_http_memcap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_http_memcap_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.ftp.memuse" => "string"
        }
        on_error => "stats_ftp_memuse_conversion_error"
      }

      mutate {
        replace => {
          "stats_ftp_memuse_labels.value" => "%{stats.ftp.memuse}"
        }
        on_error => "stats_ftp_memuse_not_found"
      }
      if ![stats_ftp_memuse_not_found] and [stats][ftp][memuse] != "" {
        mutate {
          replace => {
            "stats_ftp_memuse_labels.key" => "stats_ftp_memuse"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_ftp_memuse_labels"
          }
        }
      }

      mutate {
        convert => {
          "stats.ftp.memcap" => "string"
        }
        on_error => "stats_ftp_memcap_conversion_error"
      }

      mutate {
        replace => {
          "stats_ftp_memcap_labels.value" => "%{stats.ftp.memcap}"
        }
        on_error => "stats_ftp_memcap_not_found"
      }
      if ![stats_ftp_memcap_not_found] and [stats][ftp][memcap] != "" {
        mutate {
          replace => {
            "stats_ftp_memcap_labels.key" => "stats_ftp_memcap"
          }
        }
        mutate {
          merge => {
            "suricata_stats_about.labels" => "stats_ftp_memcap_labels"
          }
        }
      }

      mutate {
        merge => {
          "token_about" => "suricata_stats_about"
        }
        on_error => "suricata_stats_about_not_found"
      }
    }
  }

  # ----------------------------------------------------------------------
  # Logschema

  else if [_path] == "logschema" {

    # UDM > About
    mutate {
      replace => {
        "name_labels.value" => "%{name}"
      }
      on_error => "name_not_found"
    }
    if ![name_not_found] and [name] != "" {
      mutate {
        replace => {
          "name_labels.key" => "name"
        }
      }
      mutate {
        merge => {
          "logschema_about.labels" => "name_labels"
        }
      }
    }

    mutate {
      replace => {
        "text_labels.value" => "%{text}"
      }
      on_error => "text_not_found"
    }
    if ![text_not_found] and [text] != "" {
      mutate {
        replace => {
          "text_labels.key" => "text"
        }
      }
      mutate {
        merge => {
          "logschema_about.labels" => "text_labels"
        }
      }
    }

    mutate {
      replace => {
        "schema_labels.value" => "%{schema}"
      }
      on_error => "schema_not_found"
    }
    if ![schema_not_found] and [schema] != "" {
      mutate {
        replace => {
          "schema_labels.key" => "schema"
        }
      }
      mutate {
        merge => {
          "logschema_about.labels" => "schema_labels"
        }
      }
    }

    mutate {
      replace => {
        "avro_labels.value" => "%{avro}"
      }
      on_error => "avro_not_found"
    }
    if ![avro_not_found] and [avro] != "" {
      mutate {
        replace => {
          "avro_labels.key" => "avro"
        }
      }
      mutate {
        merge => {
          "logschema_about.labels" => "avro_labels"
        }
      }
    }

    mutate {
      merge => {
        "token_about" => "logschema_about"
      }
      on_error => "merge_error"
    }
  }

  mutate {
    rename => {
      "token_metadata" => "event.idm.read_only_udm.metadata"
      "token_principal" => "event.idm.read_only_udm.principal"
      "token_target" => "event.idm.read_only_udm.target"
      "token_src" => "event.idm.read_only_udm.src"
      "token_network" => "event.idm.read_only_udm.network"
      "token_about" => "event.idm.read_only_udm.about"
      "token_intermediary" => "event.idm.read_only_udm.intermediary"
      "token_extensions" => "event.idm.read_only_udm.extensions"
      "token_security_result" => "event.idm.read_only_udm.security_result"
      "token_observer" => "event.idm.read_only_udm.observer"
      "token_additional" => "event.idm.read_only_udm.additional"
    }
  }

  if [_path] in ["known_certs", "known_devices", "known_domains", "known_hosts",
  "known_names", "known_remotes", "known_services", "known_users"] {

    # For entity type validation
    if [event1][idm][entity][metadata][entity_type] == "RESOURCE" {
        mutate {
          replace => {
            "event1.idm.entity.entity.resource.resource_type" => "MUTEX"
          }
        }
        mutate {
          replace => {
            "event1.idm.entity.entity.resource.name" => "dummy_resource_name"
          }
        }
    }

    mutate {
      merge => {
        "@output" => "event1"
      }
      on_error => "failed_to_merge_event_1"
    }
  }
  else {

    @include["noun_host_asset_align.include"]

    mutate {
      merge => {
        "@output" => "event"
      }
    }
  }
}