{"action":"opened","number":8570,"pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/8570","id":220386110,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIwMzg2MTEw","html_url":"https://github.com/elastic/beats/pull/8570","diff_url":"https://github.com/elastic/beats/pull/8570.diff","patch_url":"https://github.com/elastic/beats/pull/8570.patch","issue_url":"https://api.github.com/repos/elastic/beats/issues/8570","number":8570,"state":"open","locked":false,"title":"Cherry-pick #8066 to 6.x: Introducing the add_process_metadata processor (#6789)","user":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"body":"Cherry-pick of PR #8066 to 6.x branch. Original message: \n\nThe `add_process_metadata` processor allows to enrich events based on process information obtained from a process ID.\r\n\r\n```\r\nprocessors:\r\n    - add_process_metadata:\r\n        match_pids: [ system.process.ppid ]\r\n        target: system.process.parent\r\n        fields: [ process.title ]\r\n```\r\n\r\nInternally it generates the following document:\r\n\r\n```\r\n\"process\": {\r\n  \"name\":  \"systemd\",\r\n  \"title\": \"/usr/lib/systemd/systemd --switched-root --system --deserialize 22\",\r\n  \"exe\":   \"/usr/lib/systemd/systemd\",\r\n  \"args\":  [\"/usr/lib/systemd/systemd\", \"--switched-root\", \"--system\", \"--deserialize\", \"22\"],\r\n  \"env\": {\r\n\t\"HOME\":       \"/\",\r\n        \"TERM\":       \"linux\",\r\n        \"BOOT_IMAGE\": \"/boot/vmlinuz-4.11.8-300.fc26.x86_64\",\r\n        \"LANG\":       \"en_US.UTF-8\",\r\n  },\r\n  \"pid:    1,\r\n  \"ppid:   0,\r\n  \"start_time\": \"2018-08-22T08:44:50.684Z\",\r\n}\r\n```\r\n\r\nConfiguration options\r\n\r\n#### match_pids\r\n\r\nList of fields to lookup for a PID. The processor will search the list sequentially until the field is found in the current event, and the PID lookup will be applied to the value of this field.\r\n\r\n#### target (default: '')\r\n\r\nDestination prefix where a `process` object will be created. The default is the root of the event.\r\n\r\n#### fields (default: [])\r\n\r\nList of fields to add, for example `[  'process.title', 'process.ppid' ]`. By default, the processor will add all the available fields.\r\n```\r\ntarget: system.process.parent\r\nfields: [ process.title ]\r\n```\r\nwill create `system.process.parent.process.title`.\r\n\r\n#### ignore_missing (default: true)\r\n\r\nWhen set to false, events that don't contain any of the fields in `match_pids` will cause an error.\r\n\r\n#### ~~ignore_errors (default: false)~~\r\n\r\n~~When set, the event is not discarded when errors are encountered during enrichment and the original event is returned. Possible errors scenarios include when a PID field cannot be converted to an integer or a field cannot be overwritten. It is still an error if no PID field is found. Use `ignore_missing` for that.~~\r\n\r\n#### overwrite_fields (default: false)\r\n\r\nBy default, if a target field already exists, it will not be overwritten and an error will be logged. If `overwrite_fields` is set to `true`, this condition will be ignored.\r\n\r\n#### restricted_fields (default: false)\r\n\r\nBy default, the `process.env` field is never output, to avoid leaking sensitive data. If `restricted_fields` is true, the field will be available.\r\n\r\nCloses: #6789","created_at":"2018-10-04T13:53:35Z","updated_at":"2018-10-04T13:53:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/beats/pulls/8570/commits","review_comments_url":"https://api.github.com/repos/elastic/beats/pulls/8570/comments","review_comment_url":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/beats/issues/8570/comments","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/7cd27d7b7069ba57633f13877d50fd6ddecf11aa","head":{"label":"adriansr:backport_8066_6.x","ref":"backport_8066_6.x","sha":"7cd27d7b7069ba57633f13877d50fd6ddecf11aa","user":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"repo":{"id":107399581,"node_id":"MDEwOlJlcG9zaXRvcnkxMDczOTk1ODE=","name":"beats","full_name":"adriansr/beats","private":false,"owner":{"login":"adriansr","id":15056957,"node_id":"MDQ6VXNlcjE1MDU2OTU3","avatar_url":"https://avatars1.githubusercontent.com/u/15056957?v=4","gravatar_id":"","url":"https://api.github.com/users/adriansr","html_url":"https://github.com/adriansr","followers_url":"https://api.github.com/users/adriansr/followers","following_url":"https://api.github.com/users/adriansr/following{/other_user}","gists_url":"https://api.github.com/users/adriansr/gists{/gist_id}","starred_url":"https://api.github.com/users/adriansr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriansr/subscriptions","organizations_url":"https://api.github.com/users/adriansr/orgs","repos_url":"https://api.github.com/users/adriansr/repos","events_url":"https://api.github.com/users/adriansr/events{/privacy}","received_events_url":"https://api.github.com/users/adriansr/received_events","type":"User","site_admin":false},"html_url":"https://github.com/adriansr/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":true,"url":"https://api.github.com/repos/adriansr/beats","forks_url":"https://api.github.com/repos/adriansr/beats/forks","keys_url":"https://api.github.com/repos/adriansr/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/adriansr/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/adriansr/beats/teams","hooks_url":"https://api.github.com/repos/adriansr/beats/hooks","issue_events_url":"https://api.github.com/repos/adriansr/beats/issues/events{/number}","events_url":"https://api.github.com/repos/adriansr/beats/events","assignees_url":"https://api.github.com/repos/adriansr/beats/assignees{/user}","branches_url":"https://api.github.com/repos/adriansr/beats/branches{/branch}","tags_url":"https://api.github.com/repos/adriansr/beats/tags","blobs_url":"https://api.github.com/repos/adriansr/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/adriansr/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/adriansr/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/adriansr/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/adriansr/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/adriansr/beats/languages","stargazers_url":"https://api.github.com/repos/adriansr/beats/stargazers","contributors_url":"https://api.github.com/repos/adriansr/beats/contributors","subscribers_url":"https://api.github.com/repos/adriansr/beats/subscribers","subscription_url":"https://api.github.com/repos/adriansr/beats/subscription","commits_url":"https://api.github.com/repos/adriansr/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/adriansr/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/adriansr/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/adriansr/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/adriansr/beats/contents/{+path}","compare_url":"https://api.github.com/repos/adriansr/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/adriansr/beats/merges","archive_url":"https://api.github.com/repos/adriansr/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/adriansr/beats/downloads","issues_url":"https://api.github.com/repos/adriansr/beats/issues{/number}","pulls_url":"https://api.github.com/repos/adriansr/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/adriansr/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/adriansr/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/adriansr/beats/labels{/name}","releases_url":"https://api.github.com/repos/adriansr/beats/releases{/id}","deployments_url":"https://api.github.com/repos/adriansr/beats/deployments","created_at":"2017-10-18T11:36:46Z","updated_at":"2018-09-21T09:28:43Z","pushed_at":"2018-10-04T13:53:34Z","git_url":"git://github.com/adriansr/beats.git","ssh_url":"git@github.com:adriansr/beats.git","clone_url":"https://github.com/adriansr/beats.git","svn_url":"https://github.com/adriansr/beats","homepage":"https://www.elastic.co/products/beats","size":91614,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"NOASSERTION","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"elastic:6.x","ref":"6.x","sha":"ee33d36353d19f3eb779254d870a47aa1f21f978","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":16554739,"node_id":"MDEwOlJlcG9zaXRvcnkxNjU1NDczOQ==","name":"beats","full_name":"elastic/beats","private":false,"owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/elastic/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":false,"url":"https://api.github.com/repos/elastic/beats","forks_url":"https://api.github.com/repos/elastic/beats/forks","keys_url":"https://api.github.com/repos/elastic/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/beats/teams","hooks_url":"https://api.github.com/repos/elastic/beats/hooks","issue_events_url":"https://api.github.com/repos/elastic/beats/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/beats/events","assignees_url":"https://api.github.com/repos/elastic/beats/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/beats/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/beats/tags","blobs_url":"https://api.github.com/repos/elastic/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/beats/languages","stargazers_url":"https://api.github.com/repos/elastic/beats/stargazers","contributors_url":"https://api.github.com/repos/elastic/beats/contributors","subscribers_url":"https://api.github.com/repos/elastic/beats/subscribers","subscription_url":"https://api.github.com/repos/elastic/beats/subscription","commits_url":"https://api.github.com/repos/elastic/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/beats/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/beats/merges","archive_url":"https://api.github.com/repos/elastic/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/beats/downloads","issues_url":"https://api.github.com/repos/elastic/beats/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/beats/labels{/name}","releases_url":"https://api.github.com/repos/elastic/beats/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/beats/deployments","created_at":"2014-02-05T19:01:02Z","updated_at":"2018-10-04T12:02:28Z","pushed_at":"2018-10-04T13:52:48Z","git_url":"git://github.com/elastic/beats.git","ssh_url":"git@github.com:elastic/beats.git","clone_url":"https://github.com/elastic/beats.git","svn_url":"https://github.com/elastic/beats","homepage":"https://www.elastic.co/products/beats","size":99492,"stargazers_count":6206,"watchers_count":6206,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1936,"mirror_url":null,"archived":false,"open_issues_count":945,"license":{"key":"other","name":"NOASSERTION","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":1936,"open_issues":945,"watchers":6206,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/8570"},"html":{"href":"https://github.com/elastic/beats/pull/8570"},"issue":{"href":"https://api.github.com/repos/elastic/beats/issues/8570"},"comments":{"href":"https://api.github.com/repos/elastic/beats/issues/8570/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/beats/pulls/8570/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/beats/pulls/8570/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/beats/statuses/7cd27d7b7069ba57633f13877d50fd6ddecf11aa"}},"author_association":"MEMBER","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":1,"additions":2014,"deletions":168,"changed_files":58}}
{"actor":{"display_login":"adriansr"}}