Trying to do a lookup of [process][ppid] and push the data into [process][parent] but simple testing can't even get auditbeat to start due to an error that the processor is missing. ## config: processors: - add_process_metadata: match_pids: [system.process.ppid] target: system.process.paren…

Auditbeat error with add_process_metadata missing

adrisr (Adrian Serrano) October 5, 2018, 2:58pm 2

Hi,

The add_process_metadata processor is not available in 6.4, it will appear in 6.5.0.

You can try building Auditbeat yourself from our 6.x branch once this cherry-pick is merged https://github.com/elastic/beats/pull/8570

Or build from master (7.0.0-snapshot).

Topic		Replies	Views
Parent process sometimes missing Beats auditbeat	2	477	October 8, 2019
Auditbeat [7.11.2 and 7.12.0] memory issue Beats auditbeat	8	650	April 29, 2021
Auditbeat System module: Add parent process entity_id field to process and socket events Beats auditbeat	8	1200	April 29, 2019
How to use`add_process_metadata`in packetbeat to get process.pid? Beats docker , packetbeat	0	36	July 16, 2024
If not a root account, the kubernetes metadata is not generated Beats auditbeat	4	456	October 15, 2020