I tried to follow the documentation but with no success. Am I doing something wrong or packetbeat has issues sending the process environment into the document. I am using the latest version of packetbeat 7.14.1. Sending to logstash and this is how enabled process data:
packetbeat.procs.enabled: true processors: - add_process_metadata: match_pids: [system.process.pid] target: system.process.parent restricted_fields: true include_fields: [process.env]
Please assist if you have any ideas...
Thanks a lot!