sysmon_rulename_filter.conf

filter {
  if [log_name] == "Microsoft-Windows-Sysmon/Operational"{
    if [event_data][RuleName] {
        kv {
        source => "[event_data][RuleName]"
        field_split => ","
        value_split => "="
        prefix => "mitre_"
        transform_key => "lowercase"
      }
    }
  }
}