# Process.name incomplete

**URL:** <https://discuss.elastic.co/t/process-name-incomplete/250804>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [October 2, 2020, 2:53pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804 "2020-10-02T14:53:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![wifi](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@wifi](https://discuss.elastic.co/u/wifi)\
**Post date:** [October 2, 2020, 2:53pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/1 "2020-10-02T14:53:14Z")

</div>

Somehow the process name gets cut off and i end up with process.name like "ansible-playboo" instead of "ansible-playbook"

It seems tat the name is cut off after the 15th character

I checked the mapping for process.name:

`GET metricbeat-7.9.1-000008/_mapping/field/process.name`

```
{
  "metricbeat-7.9.1-000008" : {
    "mappings" : {
      "process.name" : {
        "full_name" : "process.name",
        "mapping" : {
          "name" : {
            "type" : "keyword",
            "fields" : {
              "text" : {
                "type" : "text",
                "norms" : false
              }
            },
            "ignore_above" : 1024
          }
        }
      }
    }
  }
}

```

Can't see anything wrong... Any clues what the issue is?

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 5, 2020, 10:22pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/2 "2020-10-05T22:22:38Z")

</div>

Hello! Are you using the metricbeat system module in this case? Could you share your config for the module please? Thank you!

---

<div class="post-metadata">

**Author:** ![wifi](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@wifi](https://discuss.elastic.co/u/wifi)\
**Post date:** [October 6, 2020, 6:19am UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/3 "2020-10-06T06:19:44Z")

</div>

here it is:

```
# Module: system
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.8/metricbeat-module-system.html

- module: system
  period: 10s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    - socket_summary
    #- entropy
    #- core
    #- diskio
    #- socket
    #- service
    #- users
  process.include_top_n:
    by_cpu: 5 # include top 5 processes by CPU
    by_memory: 5 # include top 5 processes by memory

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

#- module: system
# period: 5m
# metricsets:
# - raid
# raid.mount_point: '/'
```

---

<div class="post-metadata">

**Author:** ![wifi](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@wifi](https://discuss.elastic.co/u/wifi)\
**Post date:** [October 15, 2020, 12:37pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/4 "2020-10-15T12:37:19Z")

</div>

An example document:

```
{
  "_index": "metricbeat-7.9.2-000003",
  "_type": "_doc",
  "_id": "t4k3J3UBGS9yby_KINOp",
  "_version": 1,
  "_score": null,
  "_source": {
    "@version": "1",
    "ecs": {
      "version": "1.5.0"
    },
    "tags": [
      "beats_input_raw_event"
    ],
    "service": {
      "type": "system"
    },
    "process": {
      "args": [
        "/usr/bin/python2",
        "/usr/bin/ansible-playbook",
        "--ask-vault-pass",
        "-i",
        "inventories/dev",
        "--skip-tags",
        "debug",
        "--tags",
        "install",
        "-e",
        "",
        "playbooks/filebeat.yml"
      ],
      "pid": 9628,
      "ppid": 9626,
      "pgid": 9606,
      "name": "ansible-playboo"
    },
    "metricset": {
      "period": 10000,
      "name": "process"
    },
    "system": {
      "process": {
        "memory": {
          "share": 5541888,
          "size": 467177472,
          "rss": {
            "pct": 0.002,
            "bytes": 66600960
          }
        },
        "state": "running",
        "cpu": {
          "start_time": "2020-10-14T13:04:14.000Z",
          "total": {
            "pct": 0.4792,
            "norm": {
              "pct": 0.0599
            },
            "value": 20800
          }
        },
        "cmdline": "/usr/bin/python2 /usr/bin/ansible-playbook --ask-vault-pass -i inventories/dev --skip-tags debug --tags install -e playbooks/filebeat.yml"
      }
    },
    "@timestamp": "2020-10-14T13:05:24.435Z",
    "user": {
      "name": "faadmin"
    },
    "host": {
      "architecture": "x86_64",
      "hostname": "my_kibana_server",
      "ip": [
        "10.128.113.8",
        "fe80::250:56ff:fe3e:724"
      ],
      "mac": [
        "00:50:56:3e:07:24"
      ],
      "name": "my_kibana_server",
      "os": {
        "family": "redhat",
        "version": "7.9 (Maipo)",
        "codename": "Maipo",
        "name": "Red Hat Enterprise Linux Server",
        "platform": "rhel",
        "kernel": "3.10.0-1160.2.1.el7.x86_64"
      },
      "containerized": false,
      "id": "30f130795bbc40239af1345f312f1319"
    },
    "event": {
      "module": "system",
      "duration": 63018385,
      "dataset": "system.process"
    },
    "agent": {
      "hostname": "my_kibana_server",
      "name": "my_kibana_server",
      "type": "metricbeat",
      "version": "7.9.2",
      "ephemeral_id": "dd4c76bf-42a5-40b4-b5f9-5546a3aab142",
      "id": "780381de-2def-4cdb-9df0-3e7806ebcf96"
    }
  },
  "fields": {
    "system.process.cpu.start_time": [
      "2020-10-14T13:04:14.000Z"
    ],
    "@timestamp": [
      "2020-10-14T13:05:24.435Z"
    ]
  },
  "highlight": {
    "process.name": [
      "@kibana-highlighted-field@ansible-playboo@/kibana-highlighted-field@"
    ],
    "mongodb.status.process": [
      "@kibana-highlighted-field@ansible-playboo@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1602680724435
  ]
}
```

---

<div class="post-metadata">

**Author:** ![wifi](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@wifi](https://discuss.elastic.co/u/wifi)\
**Post date:** [October 15, 2020, 1:42pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/5 "2020-10-15T13:42:08Z")

</div>

there has been a similar issue in the past:

> [@Proc.name limited to 15 chars?](https://discuss.elastic.co/t/proc-name-limited-to-15-chars/36034/3):
>
> It is already cut off in the stat file: 19211 (nac-logging-amq) S 1 19211 19211 0 -1 4202752 5873068 0 48 0 2444657 118010 0 0 20 0 1 0 363988890 143618048 3147 18446744073709551615 4194304 5777388 140726113689888 140726113689176 140479796634259 0 0 4224 0 0 0 0 17 0 0 0 16 0 0 7874544 7887424 30507008 140726113697094 140726113697600 140726113697600 140726113697736 0 It seems this is a hard limit of the proc filesystem: [http://stackoverflow.com/questions/23534263/what-is-the-maximum-allowed-…](http://stackoverflow.com/questions/23534263/what-is-the-maximum-allowed-limit-on-the-length-of-a-process-name)

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [November 3, 2020, 8:13pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/6 "2020-11-03T20:13:06Z")

</div>

I was able to reproduce this problem on my MacBook and I just created a github issue for fixing this! Thank you so much and so sorry for the delay!! [https://github.com/elastic/beats/issues/22404](https://github.com/elastic/beats/issues/22404)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2020, 10:13pm UTC](https://discuss.elastic.co/t/process-name-incomplete/250804/7 "2020-12-01T22:13:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.