[Filebeat] Improve ECS categorization field mappings for zeek module

CHANGELOG.next.asciidoc

@@ -277,6 +277,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Improve ECS categorization field mappings in postgresql module. {issue}16177[16177] {pull}17914[17914]
 - Improve ECS categorization field mappings in rabbitmq module. {issue}16178[16178] {pull}17916[17916]
 - Improve ECS categorization field mappings in redis module. {issue}16179[16179] {pull}17918[17918]
+- Improve ECS categorization field mappings for zeek module. {issue}16029[16029] {pull}17738[17738]
 
 *Heartbeat*
 

x-pack/filebeat/module/zeek/capture_loss/ingest/pipeline.yml

@@ -0,0 +1,21 @@
+description: Pipeline for normalizing Zeek capture_loss.log
+processors:
+- set:
+    field: event.created
+    value: '{{_ingest.timestamp}}'
+- date:
+    field: zeek.capture_loss.ts
+    formats:
+    - UNIX
+- remove:
+    field: zeek.capture_loss.ts
+- set:
+    field: event.kind
+    value: metric
+- set:
+    field: event.type
+    value: info
+on_failure:
+- set:
+    field: error.message
+    value: '{{ _ingest.on_failure_message }}'

x-pack/filebeat/module/zeek/capture_loss/manifest.yml

@@ -11,5 +11,5 @@ var:
   - name: tags
     default: [zeek.capture_loss]
 
-ingest_pipeline: ingest/pipeline.json
+ingest_pipeline: ingest/pipeline.yml
 input: config/capture_loss.yml

x-pack/filebeat/module/zeek/capture_loss/test/capture_loss-json.log-expected.json

@@ -2,7 +2,9 @@
     {
         "@timestamp": "2019-09-10T16:19:28.465Z",
         "event.dataset": "zeek.capture_loss",
+        "event.kind": "metric",
         "event.module": "zeek",
+        "event.type": "info",
         "fileset.name": "capture_loss",
         "input.type": "log",
         "log.offset": 0,

x-pack/filebeat/module/zeek/connection/config/connection.yml

@@ -75,20 +75,27 @@ processors:
 
       ignore_missing: true
       fail_on_error: false
-
+  - convert:
+      fields:
+        - {from: "zeek.session_id", to: "event.id"}
+        - {from: "source.address", to: "source.ip", type: "ip"}
+        - {from: "destination.address", to: "destination.ip", type: "ip"}
+      ignore_missing: true
+      fail_on_error: false
+  - add_fields:
+      target: event
+      fields:
+        kind: event
+        category:
+          - network
 {{ if .community_id }}
   - if:
       equals.network.transport: icmp
     then:
       community_id:
         fields:
-          source_ip: source.address
-          destination_ip: destination.address
           icmp_type: zeek.connection.icmp.type
           icmp_code: zeek.connection.icmp.code
     else:
       community_id:
-        fields:
-          source_ip: source.address
-          destination_ip: destination.address
 {{ end }}