fluent-bit-filters-bro.conf

[FILTER]
    Name grep
    Match ${observer_product}.*
    # ===
    # Remove commented log entries
    Exclude log ^#

@INCLUDE fluent-bit-filters-bro-conn.conf
@INCLUDE fluent-bit-filters-bro-dns.conf
@INCLUDE fluent-bit-filters-bro-dhcp.conf
@INCLUDE fluent-bit-filters-bro-ssl.conf
@INCLUDE fluent-bit-filters-bro-http.conf
@INCLUDE custom/fluent-bit-filters-zeek-zeer-hosts.conf

# ECS: Nest JSON objects to comply with ECS notation: SOURCE
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard source_*
    Nest_under source
    Remove_prefix source_

# ECS: Nest JSON objects to comply with ECS notation: DESTINATION
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard destination_*
    Nest_under destination
    Remove_prefix destination_

# ECS: Nest JSON objects to comply with ECS notation: CLIENT
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard client_*
    Nest_under client
    Remove_prefix client_

# ECS: Nest JSON objects to comply with ECS notation: SERVER
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard server_*
    Nest_under server
    Remove_prefix server_

# ECS: Nest JSON objects to comply with ECS notation: HOST
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard host_*
    Nest_under host
    Remove_prefix host_

# ECS: Nest JSON objects to comply with ECS notation: NETWORK
[FILTER]
    Name nest
    Match ${observer_product}.*
    Operation nest
    Wildcard network_*
    Nest_under network
    Remove_prefix network_