Convert rita.dns ingest pipeline to the same naming standard as zeek.dns

[johnununu]

This would allow folks to take advantage of the dns.tld pipeline enrichment.

[weslambert]

Are you referring to DNS-specific fields, or could you provide an example?

[johnununu]

The rita.dns elasticsearch ingest has naming standard of 'dns.question.[name | subdomain_count | count]
where as the zeek.dns elasticsearch ingest renames message2.query to dns.queary.name. which then uses the dns.tld pipeline.

I'm asking if the rita.dns elasticsearch ingest pipeline can match the naming standard of the zeek.dns pipeline.
Both are under /opt/so/saltstack/default/salt/elasticsearch/files/ingest

[weslambert]

Thanks for the feedback. We'll look at this as time allows.