deployment/roles/metron_streaming/files/source/snort-config.json

{
  "index": "snort",
  "batchSize": 1,
  "enrichmentFieldMap":
  {
    "geo": ["ip_dst_addr", "ip_src_addr"],
    "host": ["host"]
  },
  "threatIntelFieldMap":
  {
    "ip": ["ip_dst_addr", "ip_src_addr"]
  }
}