# How to use\`add\_process\_metadata\`in packetbeat to get process.pid?

**URL:** <https://discuss.elastic.co/t/how-to-use-add-process-metadata-in-packetbeat-to-get-process-pid/363217>\
**Category:** Beats\
**Tags:** docker, packetbeat\
**Created:** [July 16, 2024, 11:57am UTC](https://discuss.elastic.co/t/how-to-use-add-process-metadata-in-packetbeat-to-get-process-pid/363217 "2024-07-16T11:57:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![asdfsx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asdfsx/32/135680_2.png) [@asdfsx](https://discuss.elastic.co/u/asdfsx)\
**Post date:** [July 16, 2024, 11:57am UTC](https://discuss.elastic.co/t/how-to-use-add-process-metadata-in-packetbeat-to-get-process-pid/363217/1 "2024-07-16T11:57:23Z")

</div>

I start my packetbeat by docker-compose, and tring to use `add_process_metadata` to add `process.pid` to the packet data. But I failed, the process.pid is always empty.

I use following docker-compose to start the packetbeat

```auto
version: "3.8"

networks:
  default:
    name: elastic
    external: false
  packetbeat:
    image: docker.elastic.co/beats/packetbeat:${STACK_VERSION}
    user: packetbeat
    volumes:
      - "./packetbeat.yml:/usr/share/packetbeat/packetbeat.yml:ro"
      - "/proc:/hostfs/proc:ro"
    cap_add:
      - NET_RAW
      - NET_ADMIN
    network_mode: host
    command:
      - --strict.perms=false

```

And the be like packetbeat.yml

```auto
output:
  elasticsearch:
    hosts:
    - 172.18.1.111:9200
    protocol: http
packetbeat:
  flows:
    period: 10s
    timeout: 30s
  interfaces:
    device: any
  protocols:
    - enabled: true
      type: icmp
    - ports:
      - 80
      type: http
    ......
processors:
- add_process_metadata:
    match_pids:
      - process.pid
    host_path: /hostfs

```

Can someone give me some suggestion?