I was wondering if we could discuss/add mime_type as a nested field.
There is a bit discussed on this already over at #554, however since it started as HTTP specific header fields, I think it may have gotten lost in the mix and mime type's deserve their own issue :)

I think this would be a pretty quick win that would benefit setting up some nice analytics and just all around schema for a lot of logs.

a really easy "analytic" is something like file.mime_type:"application/x-dosexec" AND NOT file.extension:(exe OR dll OR msi)

Some type of logs and things that would benefit:

• Suricata HTTP
• Suricata Alert
• Yara and other file scanning
• AV, EDR, and or Sandbox
• Zeek HTTP
• Zeek SMTP
• Zeek File
• Zeek FTP
• Anything else containing HTTP/SMTP logs (Squid, PaloAlto, etc...)

Miss you @webmat ;)