DNS Header Flag fields that are boolean, can I convert this to ECS by just having one object
Teach me, oh Pipeline Wizards.... I have DNS Header Flag fields coming in that are boolean, like `aa: false`, `ra: true`, `rd: true`, `tc: false`, etc. I would like to convert this to ECS by just having one object (`dns.header_flags`) with an array of the header flag names show in an array if their above referenced field value is `true`. So the JSON would end up being structured like this. ```"dns": { "header_flags": [ "rd","rd" ],``` And the false fields would be dropped. I would also like to be able to do this in one function instead of a function with a filter for each potential Header Flag Field.
0