Trying to do a lookup of [process][ppid] and push the data into [process][parent] but simple testing can't even get auditbeat to start due to an error that the processor is missing.
## config:
processors:
- add_process_metadata:
match_pids: [system.process.ppid]
target: system.process.parent
## Error:
2018-10-05T09:28:15.589-0500 ERROR instance/beat.go:743 Exiting: error initializing publisher: error initializing processors: the processor add_process_metadata doesn't exist
## version:
auditbeat version 6.4.1 (amd64), libbeat 6.4.1 [37b5f2d2a20f2734b2373a454b4b4cbb2627e841 built 2018-09-13 21:23:13 +0000 UTC]
## Tested with newest 6.4.2
2018-10-05T09:45:15.541-0500 INFO instance/beat.go:273 Setup Beat: auditbeat; Version: 6.4.2
2018-10-05T09:45:15.541-0500 INFO instance/beat.go:327 auditbeat stopped.
2018-10-05T09:45:15.542-0500 ERROR instance/beat.go:743 Exiting: error initializing publisher: error initializing processors: the processor add_process_metadata doesn't exist
Has anyone been able to get this processor to work?