I am using this processor to get information about process parent:
match_pids: [ process.ppid ]
but sometimes is parent process missing in auditbeat messages
I found this issues for processes started from crontab, but looks like there also other processes without parent.
Do you please know why is parent process missing or how to investigate this issue ?