diff --git a/conf/cloudflare-ingest-pipeline-daily.json b/conf/cloudflare-ingest-pipeline-daily-v7.json similarity index 100% rename from conf/cloudflare-ingest-pipeline-daily.json rename to conf/cloudflare-ingest-pipeline-daily-v7.json diff --git a/conf/cloudflare-ingest-pipeline-daily-v8.json b/conf/cloudflare-ingest-pipeline-daily-v8.json new file mode 100644 index 0000000..e2b9131 --- /dev/null +++ b/conf/cloudflare-ingest-pipeline-daily-v8.json @@ -0,0 +1,595 @@ +{ + "description": "Cloudflare Log Pipeline (Daily Indices)", + "processors": [ + { + "date": { + "field": "EdgeStartTimestamp", + "formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ], + "timezone": "UTC", + "target_field": "@timestamp" + } + }, + { + "date": { + "field": "EdgeStartTimestamp", + "formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ], + "timezone": "UTC", + "target_field": "EdgeStartTimestamp" + } + }, + { + "date_index_name": { + "field": "EdgeStartTimestamp", + "index_name_prefix": "cloudflare-", + "date_rounding": "d", + "timezone": "UTC", + "date_formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ] + } + }, + { + "geoip": { + "field": "ClientIP", + "target_field": "source.geo", + "properties": [ + "ip", + "country_name", + "continent_name", + "region_iso_code", + "region_name", + "city_name", + "timezone", + "location" + ] + } + }, + { + "dissect": { + "field": "ClientRequestProtocol", + "pattern": "HTTP/%{http.version}" + } + }, + { + "rename": { + "field": "ClientRequestProtocol", + "target_field": "cloudflare.client.request.protocol", + "ignore_missing": true + } + }, + { + "set": { + "field": "ecs.version", + "value": "1.1.0" + } + }, + { + "set": { + "field": "observer.vendor", + "value": "Cloudflare" + } + }, + { + "set": { + "field": "observer.type", + "value": "proxy" + } + }, + { + "set": { + "field": "event.dataset", + "value": "cloudflare.log" + } + }, + { + "rename": { + "field": "CacheCacheStatus", + "target_field": "cloudflare.cache.status", + "ignore_missing": true + } + }, + { + "set": { + "field": "http.response.bytes", + "value": "{{CacheResponseBytes}}" + } + }, + { + "rename": { + "field": "CacheResponseBytes", + "target_field": "cloudflare.cache.response.bytes", + "ignore_missing": true + } + }, + { + "set": { + "field": "http.response.status_code", + "value": "{{CacheResponseStatus}}" + } + }, + { + "rename": { + "field": "CacheResponseStatus", + "target_field": "cloudflare.cache.response.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "CacheTieredFill", + "target_field": "cloudflare.cache.tiered.fill", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientASN", + "target_field": "source.as.number", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientCountry", + "target_field": "source.geo.country_iso_code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientDeviceType", + "target_field": "cloudflare.device.type", + "ignore_missing": true + } + }, + { + "set": { + "field": "source.address", + "value": "{{ClientIP}}" + } + }, + { + "set": { + "field": "client.ip", + "value": "{{ClientIP}}" + } + }, + { + "set": { + "field": "client.address", + "value": "{{ClientIP}}" + } + }, + { + "rename": { + "field": "ClientIP", + "target_field": "source.ip", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientIPClass", + "target_field": "cloudflare.client.ip.class", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestBytes", + "target_field": "http.request.bytes", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestHost", + "target_field": "url.domain", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestMethod", + "target_field": "http.request.method", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestPath", + "target_field": "url.path", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestReferer", + "target_field": "http.request.referrer", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestURI", + "target_field": "url.full", + "ignore_missing": true + } + }, + { + "user_agent" : { + "field" : "ClientRequestUserAgent", + "target_field": "user_agent", + "ignore_missing": true + } + }, + { + "set": { + "field": "user_agent.original", + "value": "{{ClientRequestUserAgent}}" + } + }, + { + "remove" : { + "field": "ClientRequestUserAgent", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientSSLCipher", + "target_field": "cloudflare.client.ssl.cipher", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientSSLProtocol", + "target_field": "cloudflare.client.ssl.protocol", + "ignore_missing": true + } + }, + { + "set": { + "field": "client.port", + "value": "{{ClientSrcPort}}" + } + }, + { + "rename": { + "field": "ClientSrcPort", + "target_field": "source.port", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeColoCode", + "target_field": "cloudflare.edge.colo.code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeColoID", + "target_field": "cloudflare.edge.colo.id", + "ignore_missing": true + } + }, + { + "set": { + "field": "event.end", + "value": "{{EdgeEndTimestamp}}" + } + }, + { + "rename": { + "field": "EdgeEndTimestamp", + "target_field": "cloudflare.edge.end.timestamp", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingOp", + "target_field": "cloudflare.edge.pathing.op", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingSrc", + "target_field": "cloudflare.edge.pathing.src", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingStatus", + "target_field": "cloudflare.edge.pathing.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRateLimitAction", + "target_field": "cloudflare.edge.rate.limit.action", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRateLimitID", + "target_field": "cloudflare.edge.rate.limit.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRequestHost", + "target_field": "cloudflare.edge.request.host", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseBytes", + "target_field": "cloudflare.edge.response.bytes", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseCompressionRatio", + "target_field": "cloudflare.edge.response.compression_ratio", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseContentType", + "target_field": "cloudflare.edge.response.content_type", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseStatus", + "target_field": "cloudflare.edge.response.status", + "ignore_missing": true + } + }, + { + "set": { + "field": "observer.ip", + "value": "{{EdgeServerIP}}" + } + }, + { + "rename": { + "field": "EdgeServerIP", + "target_field": "cloudflare.edge.server.ip", + "ignore_missing": true + } + }, + { + "set": { + "field": "event.start", + "value": "{{EdgeStartTimestamp}}" + } + }, + { + "rename": { + "field": "EdgeStartTimestamp", + "target_field": "cloudflare.edge.start.timestamp", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesActions", + "target_field": "cloudflare.firewall.matches.actions", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesSources", + "target_field": "cloudflare.firewall.matches.sources", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesRuleIDs", + "target_field": "cloudflare.firewall.matches.rule_ids", + "ignore_missing": true + } + }, + { + "set": { + "field": "server.ip", + "value": "{{OriginIP}}" + } + }, + { + "set": { + "field": "cloudflare.origin.ip", + "value": "{{OriginIP}}" + } + }, + { + "rename": { + "field": "OriginIP", + "target_field": "destination.ip", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseBytes", + "target_field": "cloudflare.origin.response.bytes", + "ignore_missing": true + } + }, + { + "remove" : { + "if" : "ctx.OriginResponseHTTPExpires == ''", + "field" : "OriginResponseHTTPExpires" + } + }, + { + "rename": { + "field": "OriginResponseHTTPExpires", + "target_field": "cloudflare.origin.response.http.expires", + "ignore_missing": true + } + }, + { + "remove" : { + "if" : "ctx.OriginResponseHTTPLastModified == ''", + "field" : "OriginResponseHTTPLastModified" + } + }, + { + "rename": { + "field": "OriginResponseHTTPLastModified", + "target_field": "cloudflare.origin.response.http.last_modified", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseStatus", + "target_field": "cloudflare.http.response.status_code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseTime", + "target_field": "cloudflare.origin.response.time", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginSSLProtocol", + "target_field": "cloudflare.origin.ssl.protocol", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ParentRayID", + "target_field": "cloudflare.parent.ray_id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "RayID", + "target_field": "cloudflare.ray_id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "SecurityLevel", + "target_field": "cloudflare.security_level", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFAction", + "target_field": "cloudflare.waf.action", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFFlags", + "target_field": "cloudflare.waf.flags", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFMatchedVar", + "target_field": "cloudflare.waf.matched_var", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFProfile", + "target_field": "cloudflare.waf.profile", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFRuleID", + "target_field": "cloudflare.waf.rule.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFRuleMessage", + "target_field": "cloudflare.waf.rule.message", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerCPUTime", + "target_field": "cloudflare.worker.cpu_time", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerStatus", + "target_field": "cloudflare.worker.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerSubrequest", + "target_field": "cloudflare.worker.subrequest", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerSubrequestCount", + "target_field": "cloudflare.worker.subrequest_count", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ZoneID", + "target_field": "cloudflare.zone_id", + "ignore_missing": true + } + } + ] +} + diff --git a/conf/cloudflare-ingest-pipeline-weekly.json b/conf/cloudflare-ingest-pipeline-weekly-v7.json similarity index 100% rename from conf/cloudflare-ingest-pipeline-weekly.json rename to conf/cloudflare-ingest-pipeline-weekly-v7.json diff --git a/conf/cloudflare-ingest-pipeline-weekly-v8.json b/conf/cloudflare-ingest-pipeline-weekly-v8.json new file mode 100644 index 0000000..78b2367 --- /dev/null +++ b/conf/cloudflare-ingest-pipeline-weekly-v8.json @@ -0,0 +1,595 @@ +{ + "description": "Cloudflare Log Pipeline (Weekly Indices)", + "processors": [ + { + "date": { + "field": "EdgeStartTimestamp", + "formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ], + "timezone": "UTC", + "target_field": "@timestamp" + } + }, + { + "date": { + "field": "EdgeStartTimestamp", + "formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ], + "timezone": "UTC", + "target_field": "EdgeStartTimestamp" + } + }, + { + "date_index_name": { + "field": "EdgeStartTimestamp", + "index_name_prefix": "cloudflare-", + "date_rounding": "w", + "timezone": "UTC", + "date_formats": [ + "uuuu-MM-dd'T'HH:mm:ssX", + "uuuu-MM-dd'T'HH:mm:ss.SSSX", + "yyyy-MM-dd'T'HH:mm:ssZ", + "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + ] + } + }, + { + "geoip": { + "field": "ClientIP", + "target_field": "source.geo", + "properties": [ + "ip", + "country_name", + "continent_name", + "region_iso_code", + "region_name", + "city_name", + "timezone", + "location" + ] + } + }, + { + "dissect": { + "field": "ClientRequestProtocol", + "pattern": "HTTP/%{http.version}" + } + }, + { + "rename": { + "field": "ClientRequestProtocol", + "target_field": "cloudflare.client.request.protocol", + "ignore_missing": true + } + }, + { + "set": { + "field": "ecs.version", + "value": "1.1.0" + } + }, + { + "set": { + "field": "observer.vendor", + "value": "Cloudflare" + } + }, + { + "set": { + "field": "observer.type", + "value": "proxy" + } + }, + { + "set": { + "field": "event.dataset", + "value": "cloudflare.log" + } + }, + { + "rename": { + "field": "CacheCacheStatus", + "target_field": "cloudflare.cache.status", + "ignore_missing": true + } + }, + { + "set": { + "field": "http.response.bytes", + "value": "{{CacheResponseBytes}}" + } + }, + { + "rename": { + "field": "CacheResponseBytes", + "target_field": "cloudflare.cache.response.bytes", + "ignore_missing": true + } + }, + { + "set": { + "field": "http.response.status_code", + "value": "{{CacheResponseStatus}}" + } + }, + { + "rename": { + "field": "CacheResponseStatus", + "target_field": "cloudflare.cache.response.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "CacheTieredFill", + "target_field": "cloudflare.cache.tiered.fill", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientASN", + "target_field": "source.as.number", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientCountry", + "target_field": "source.geo.country_iso_code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientDeviceType", + "target_field": "cloudflare.device.type", + "ignore_missing": true + } + }, + { + "set": { + "field": "source.address", + "value": "{{ClientIP}}" + } + }, + { + "set": { + "field": "client.ip", + "value": "{{ClientIP}}" + } + }, + { + "set": { + "field": "client.address", + "value": "{{ClientIP}}" + } + }, + { + "rename": { + "field": "ClientIP", + "target_field": "source.ip", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientIPClass", + "target_field": "cloudflare.client.ip.class", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestBytes", + "target_field": "http.request.bytes", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestHost", + "target_field": "url.domain", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestMethod", + "target_field": "http.request.method", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestPath", + "target_field": "url.path", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestReferer", + "target_field": "http.request.referrer", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientRequestURI", + "target_field": "url.full", + "ignore_missing": true + } + }, + { + "user_agent" : { + "field" : "ClientRequestUserAgent", + "target_field": "user_agent", + "ignore_missing": true + } + }, + { + "set": { + "field": "user_agent.original", + "value": "{{ClientRequestUserAgent}}" + } + }, + { + "remove" : { + "field": "ClientRequestUserAgent", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientSSLCipher", + "target_field": "cloudflare.client.ssl.cipher", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ClientSSLProtocol", + "target_field": "cloudflare.client.ssl.protocol", + "ignore_missing": true + } + }, + { + "set": { + "field": "client.port", + "value": "{{ClientSrcPort}}" + } + }, + { + "rename": { + "field": "ClientSrcPort", + "target_field": "source.port", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeColoCode", + "target_field": "cloudflare.edge.colo.code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeColoID", + "target_field": "cloudflare.edge.colo.id", + "ignore_missing": true + } + }, + { + "set": { + "field": "event.end", + "value": "{{EdgeEndTimestamp}}" + } + }, + { + "rename": { + "field": "EdgeEndTimestamp", + "target_field": "cloudflare.edge.end.timestamp", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingOp", + "target_field": "cloudflare.edge.pathing.op", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingSrc", + "target_field": "cloudflare.edge.pathing.src", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgePathingStatus", + "target_field": "cloudflare.edge.pathing.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRateLimitAction", + "target_field": "cloudflare.edge.rate.limit.action", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRateLimitID", + "target_field": "cloudflare.edge.rate.limit.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeRequestHost", + "target_field": "cloudflare.edge.request.host", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseBytes", + "target_field": "cloudflare.edge.response.bytes", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseCompressionRatio", + "target_field": "cloudflare.edge.response.compression_ratio", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseContentType", + "target_field": "cloudflare.edge.response.content_type", + "ignore_missing": true + } + }, + { + "rename": { + "field": "EdgeResponseStatus", + "target_field": "cloudflare.edge.response.status", + "ignore_missing": true + } + }, + { + "set": { + "field": "observer.ip", + "value": "{{EdgeServerIP}}" + } + }, + { + "rename": { + "field": "EdgeServerIP", + "target_field": "cloudflare.edge.server.ip", + "ignore_missing": true + } + }, + { + "set": { + "field": "event.start", + "value": "{{EdgeStartTimestamp}}" + } + }, + { + "rename": { + "field": "EdgeStartTimestamp", + "target_field": "cloudflare.edge.start.timestamp", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesActions", + "target_field": "cloudflare.firewall.matches.actions", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesSources", + "target_field": "cloudflare.firewall.matches.sources", + "ignore_missing": true + } + }, + { + "rename": { + "field": "FirewallMatchesRuleIDs", + "target_field": "cloudflare.firewall.matches.rule_ids", + "ignore_missing": true + } + }, + { + "set": { + "field": "server.ip", + "value": "{{OriginIP}}" + } + }, + { + "set": { + "field": "cloudflare.origin.ip", + "value": "{{OriginIP}}" + } + }, + { + "rename": { + "field": "OriginIP", + "target_field": "destination.ip", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseBytes", + "target_field": "cloudflare.origin.response.bytes", + "ignore_missing": true + } + }, + { + "remove" : { + "if" : "ctx.OriginResponseHTTPExpires == ''", + "field" : "OriginResponseHTTPExpires" + } + }, + { + "rename": { + "field": "OriginResponseHTTPExpires", + "target_field": "cloudflare.origin.response.http.expires", + "ignore_missing": true + } + }, + { + "remove" : { + "if" : "ctx.OriginResponseHTTPLastModified == ''", + "field" : "OriginResponseHTTPLastModified" + } + }, + { + "rename": { + "field": "OriginResponseHTTPLastModified", + "target_field": "cloudflare.origin.response.http.last_modified", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseStatus", + "target_field": "cloudflare.http.response.status_code", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginResponseTime", + "target_field": "cloudflare.origin.response.time", + "ignore_missing": true + } + }, + { + "rename": { + "field": "OriginSSLProtocol", + "target_field": "cloudflare.origin.ssl.protocol", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ParentRayID", + "target_field": "cloudflare.parent.ray_id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "RayID", + "target_field": "cloudflare.ray_id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "SecurityLevel", + "target_field": "cloudflare.security_level", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFAction", + "target_field": "cloudflare.waf.action", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFFlags", + "target_field": "cloudflare.waf.flags", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFMatchedVar", + "target_field": "cloudflare.waf.matched_var", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFProfile", + "target_field": "cloudflare.waf.profile", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFRuleID", + "target_field": "cloudflare.waf.rule.id", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WAFRuleMessage", + "target_field": "cloudflare.waf.rule.message", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerCPUTime", + "target_field": "cloudflare.worker.cpu_time", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerStatus", + "target_field": "cloudflare.worker.status", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerSubrequest", + "target_field": "cloudflare.worker.subrequest", + "ignore_missing": true + } + }, + { + "rename": { + "field": "WorkerSubrequestCount", + "target_field": "cloudflare.worker.subrequest_count", + "ignore_missing": true + } + }, + { + "rename": { + "field": "ZoneID", + "target_field": "cloudflare.zone_id", + "ignore_missing": true + } + } + ] +} +