Add new field using part of existing value

[Badger]

If you do not want to modify process_path then do not overwrite it:

grok {
    match => { "process_path" => [
        "\\(?<process_name>[^\\]+)$",
        "/(?<process_name>[^/]+)$",
        ]
    }
}