Add process metadata
editAdd process metadata
editThe add_process_metadata
processor enriches events with information from running
processes, identified by their process ID (PID).
Example
edit- add_process_metadata: match_pids: [system.process.ppid] target: system.process.parent
The fields added to the event look as follows:
"process": { "name": "systemd", "title": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22", "exe": "/usr/lib/systemd/systemd", "args": ["/usr/lib/systemd/systemd", "--switched-root", "--system", "--deserialize", "22"], "pid": 1, "parent": { "pid": 0 }, "start_time": "2018-08-22T08:44:50.684Z", "owner": { "name": "root", "id": "0" } }, "container": { "id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1" },
Optionally, the process environment can be included, too:
... "env": { "HOME": "/", "TERM": "linux", "BOOT_IMAGE": "/boot/vmlinuz-4.11.8-300.fc26.x86_64", "LANG": "en_US.UTF-8", } ...
Configuration settings
editElastic Agent processors execute before ingest pipelines, which means that they process the raw event data rather than the final event sent to Elasticsearch. For related limitations, refer to What are some limitations of using processors?
Name | Required | Default | Description |
---|---|---|---|
|
Yes |
List of fields to lookup for a PID. The processor searches the list sequentially until the field is found in the current event, and the PID lookup is then applied to the value of this field. |
|
|
No |
event root |
Destination prefix where the |
|
No |
List of fields to add. By default, adds all available fields except |
|
|
No |
|
Whether to ignore missing fields. If |
|
No |
|
Whether to overwrite existing keys. If |
|
No |
|
Whether to output restricted fields. If |
|
No |
root directory ( |
Host path where |
|
No |
|
Prefix where the container ID is inside cgroup. For different runtime configurations of Kubernetes or Docker, set |
|
No |
Regular expression with capture group for capturing the container ID from the cgroup path. For example:
If |
|
|
No |
|
Time in seconds before cgroup cache elements expire. To disable the cgroup cache, set this to |