{
    "description": "Pipeline for normalizing MISP threat",
    "processors": [
      {
        "set": {
          "field": "event.ingested",
          "value": "{{_ingest.timestamp}}"
        }
      },
      {
        "geoip": {
          "field": "destination.ip",
          "target_field": "destination.geo",
          "ignore_missing": true
        }
      },
      {
        "geoip": {
          "field": "source.ip",
          "target_field": "source.geo",
          "ignore_missing": true
        }
      }
    ],
    "on_failure" : [{ 
      "set" : { 
        "field" : "error.message", 
        "value" : "{{ _ingest.on_failure_message }}" 
      } 
    }]
  }
  