process.yml

# HEADS UP
# This field set supports capturing the parent process (one level).
#
# Doing so via normal reuse/nesting is tricky mainly because it's reused as a
# different name: the "process" field set is nested as "parent".
# This is the only occurrence of this in ECS, so it's not supported.
#
# The workaround is to simply duplicate each field to generate the "parent.*"
# equivalent of each "process.*" field. Please maintain each duplicate exactly as
# the main field (e.g. same wording & example), as if it was normal nesting.
#
# Each such duplicated field for the parent process is directly below the original
# field, which will hopefully help maintain this until a better solution is in place.

---
- name: process
  title: Process
  group: 2
  short: These fields contain information about a process.
  description: >
    These fields contain information about a process.

    These fields can help you correlate metrics information with a process id/name
    from a log message.  The `process.pid` often stays in the metric itself and is
    copied to the global field for correlation.
  type: group
  fields:

    - name: pid
      format: string
      level: core
      type: long
      description: >
        Process id.
      example: 4242

    - name: parent.pid
      format: string
      level: core
      type: long
      description: >
        Process id.
      example: 4242


    - name: name
      level: extended
      type: keyword
      short: Process name.
      description: >
        Process name.

        Sometimes called program name or similar.
      example: ssh
      multi_fields:
      - type: text
        name: text

    - name: parent.name
      level: extended
      type: keyword
      short: Process name.
      description: >
        Process name.

        Sometimes called program name or similar.
      example: ssh
      multi_fields:
      - type: text
        name: text


    - name: ppid
      format: string
      level: extended
      type: long
      description: >
        Parent process' pid.
      example: 4241

    - name: parent.ppid
      format: string
      level: extended
      type: long
      description: >
        Parent process' pid.
      example: 4241


    - name: pgid
      format: string
      level: extended
      type: long
      description: >
        Identifier of the group of processes the process belongs to.

    - name: parent.pgid
      format: string
      level: extended
      type: long
      description: >
        Identifier of the group of processes the process belongs to.


    - name: command_line
      level: extended
      type: keyword
      short: Full command line that started the process.
      description: >
        Full command line that started the process, including the absolute path
        to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.
      example: "/usr/bin/ssh -l user 10.0.0.16"
      multi_fields:
      - type: text
        name: text

    - name: parent.command_line
      level: extended
      type: keyword
      short: Full command line that started the process.
      description: >
        Full command line that started the process, including the absolute path
        to the executable, and all arguments.

        Some arguments may be filtered to protect sensitive information.
      example: "/usr/bin/ssh -l user 10.0.0.16"
      multi_fields:
      - type: text
        name: text


    - name: args
      level: extended
      type: keyword
      short: Array of process arguments.
      description: >
        Array of process arguments, starting with the absolute path to the executable.

        May be filtered to protect sensitive information.
      example: ["/usr/bin/ssh", "-l", "user", "10.0.0.16"]

    - name: parent.args
      level: extended
      type: keyword
      short: Array of process arguments.
      description: >
        Array of process arguments.

        May be filtered to protect sensitive information.
      example: ["ssh", "-l", "user", "10.0.0.16"]

    - name: args_count
      level: extended
      type: long
      short: Length of the process.args array.
      description: >
        Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on
        how many arguments were provided to start a process.
        More arguments may be an indication of suspicious activity.
      example: 4

    - name: parent.args_count
      level: extended
      type: long
      short: Length of the process.args array.
      description: >
        Length of the process.args array.

        This field can be useful for querying or performing bucket analysis on
        how many arguments were provided to start a process.
        More arguments may be an indication of suspicious activity.
      example: 4


    - name: executable
      level: extended
      type: keyword
      description: >
        Absolute path to the process executable.
      example: /usr/bin/ssh
      multi_fields:
      - type: text
        name: text

    - name: parent.executable
      level: extended
      type: keyword
      description: >
        Absolute path to the process executable.
      example: /usr/bin/ssh
      multi_fields:
      - type: text
        name: text


    - name: title
      level: extended
      type: keyword
      short: Process title.
      description: >
        Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.
      multi_fields:
      - type: text
        name: text

    - name: parent.title
      level: extended
      type: keyword
      short: Process title.
      description: >
        Process title.

        The proctitle, some times the same as process name. Can also be different:
        for example a browser setting its title to the web page currently opened.
      multi_fields:
      - type: text
        name: text


    - name: thread.id
      format: string
      level: extended
      type: long
      example: 4242
      description: >
        Thread ID.

    - name: parent.thread.id
      format: string
      level: extended
      type: long
      example: 4242
      description: >
        Thread ID.


    - name: thread.name
      level: extended
      type: keyword
      example: 'thread-0'
      description: >
        Thread name.

    - name: parent.thread.name
      level: extended
      type: keyword
      example: 'thread-0'
      description: >
        Thread name.


    - name: start
      level: extended
      type: date
      example: "2016-05-23T08:05:34.853Z"
      description: >
        The time the process started.

    - name: parent.start
      level: extended
      type: date
      example: "2016-05-23T08:05:34.853Z"
      description: >
        The time the process started.


    - name: uptime
      level: extended
      type: long
      example: 1325
      description: >
        Seconds the process has been up.

    - name: parent.uptime
      level: extended
      type: long
      example: 1325
      description: >
        Seconds the process has been up.


    - name: working_directory
      level: extended
      type: keyword
      example: /home/alice
      description: >
        The working directory of the process.
      multi_fields:
      - type: text
        name: text

    - name: parent.working_directory
      level: extended
      type: keyword
      example: /home/alice
      description: >
        The working directory of the process.
      multi_fields:
      - type: text
        name: text


    - name: exit_code
      level: extended
      type: long
      example: 137
      short: The exit code of the process.
      description: >
        The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g.
        process start).

    - name: parent.exit_code
      level: extended
      type: long
      example: 137
      short: The exit code of the process.
      description: >
        The exit code of the process, if this is a termination event.

        The field should be absent if there is no exit code for the event (e.g.
        process start).