Packetbeat 7.14.1 process.env not added to the document

Elastic Security SIEM
1

Hello there,

I tried to follow the documentation but with no success. Am I doing something wrong or packetbeat has issues sending the process environment into the document. I am using the latest version of packetbeat 7.14.1. Sending to logstash and this is how enabled process data:

packetbeat.procs.enabled: true

processors:
  - add_process_metadata:
      match_pids: [system.process.pid]
      target: system.process.parent
      restricted_fields: true
      include_fields: [process.env]

Please assist if you have any ideas...
Thanks a lot!
Rodrigo.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.