---
description: Pipeline for parsing Sophos XG firewall logs (wireless protection pipeline).
processors:
#######################
## ECS Event Mapping ##
#######################
- set:
    field: event.kind
    value: event
- set:
    field: event.outcome
    value: success
- convert:
    field: sophos.xg.clients_conn_ssid
    type: long
    ignore_missing: true
    on_failure:
      - remove:
          field: sophos.xg.clients_conn_ssid

#############
## Cleanup ##
#############
on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'
