fluent-bit-filters-bro-ssl-custom.conf

##################################################################
# Use this file to add transformations into ECS format 
# for optional and extended Zeek SSL fields.

# ssl.log
[FILTER]
    Name modify
    Match ${observer_product}.ssl*
    Rename zeek_ssl_ja3 tls_client_ja3
    Rename zeek_ssl_ja3s tls_server_ja3s