DNS Header Flag fields that are boolean, can I convert this to ECS by just having one object

Teach me, oh Pipeline Wizards....I have DNS Header Flag fields coming in that are boolean, like `aa: false`, `ra: true`, `rd: true`, `tc: false`, etc. I would like to convert this to ECS by just having one object (`dns.header_flags`) with an array of the header flag names show in an array if their above referenced field value is `true`. So the JSON would end up being structured like this.```"dns": { "header_flags": [ "rd","rd" ],```And the false fields would be dropped. I would also like to be able to do this in one function instead of a function with a filter for each potential Header Flag Field.