First I recommend to "upgrade" to metricbeat. If you then use the process metricset you see there is the cmdline in the data: https://www.elastic.co/guide/en/beats/metricbeat/5.0/metricbeat-metricset-system-process.html This should help in your case I think? Let me know if that works.