Process fields

Elastic Stack Serverless

These fields contain information about a process.

These fields can help you correlate metrics information with a process id/name from a log message. The process.pid often stays in the metric itself and is copied to the global field for correlation.

Field	Description	Level
process.args	Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. type: keyword Note: this field should contain an array of values. example: ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] process.command_args	extended
process.args_count	Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. type: long example: 4 process.args_count	extended
process.command_line	Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. type: wildcard Multi-fields: - process.command_line.text (type: match_only_text) example: /usr/bin/ssh -l user 10.0.0.16 process.command_line	extended
process.end	The time the process ended. type: date example: 2016-05-23T08:05:34.853Z	extended
process.entity_id	Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. type: keyword example: c2c455d9f99375d	extended
process.entry_meta.type	The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console Note: This field is only set on process.session_leader. type: keyword	extended
process.env_vars	Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution. May be filtered to protect sensitive information. type: keyword Note: this field should contain an array of values. example: ["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]	extended
process.executable	Absolute path to the process executable. type: keyword Multi-fields: - process.executable.text (type: match_only_text) example: /usr/bin/ssh process.executable.path	extended
process.exit_code	The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). type: long example: 137	extended
process.interactive	Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. type: boolean example: True process.interactive	extended
process.io	A chunk of input or output (IO) from a single process. This field only appears on the top level process object, which is the process that wrote the output or read the input. type: object	extended
process.io.bytes_skipped	An array of byte offsets and lengths denoting where IO data has been skipped. type: object Note: this field should contain an array of values.	extended
process.io.bytes_skipped.length	The length of bytes skipped. type: long	extended
process.io.bytes_skipped.offset	The byte offset into this event’s io.text (or io.bytes in the future) where length bytes were skipped. type: long	extended
process.io.max_bytes_per_process_exceeded	If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting. type: boolean	extended
process.io.text	A chunk of output or input sanitized to UTF-8. Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word. type: wildcard	extended
process.io.total_bytes_captured	The total number of bytes captured in this event. type: long	extended
process.io.total_bytes_skipped	The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero type: long	extended
process.io.type	The type of object on which the IO action (read or write) was taken. Currently only tty is supported. Other types may be added in the future for file and socket support. type: keyword	extended
process.name	Process name. Sometimes called program name or similar. type: keyword Multi-fields: - process.name.text (type: match_only_text) example: ssh	extended
process.pgid	Deprecated for removal in next major version release. This field is superseded by process.group_leader.pid. Identifier of the group of processes the process belongs to. type: long	extended
process.pid	Process id. type: long example: 4242 process.pid	core
process.same_as_process	This boolean is used to identify if a leader process is the same as the top level process. For example, if process.group_leader.same_as_process = true, it means the process event in question is the leader of its process group. Details under process.* like pid would be the same under process.group_leader.* The same applies for both process.session_leader and process.entry_leader. This field exists to the benefit of EQL and other rule engines since it’s not possible to compare equality between two fields in a single document. e.g process.entity_id = process.group_leader.entity_id (top level process is the process group leader) OR process.entity_id = process.entry_leader.entity_id (top level process is the entry session leader) Instead these rules could be written like: process.group_leader.same_as_process: true OR process.entry_leader.same_as_process: true Note: This field is only set on process.entry_leader, process.session_leader and process.group_leader. type: boolean example: True	extended
process.start	The time the process started. type: date example: 2016-05-23T08:05:34.853Z	extended
process.thread.capabilities.effective	This is the set of capabilities used by the kernel to perform permission checks for the thread. type: keyword Note: this field should contain an array of values. example: ["CAP_BPF", "CAP_SYS_ADMIN"]	extended
process.thread.capabilities.permitted	This is a limiting superset for the effective capabilities that the thread may assume. type: keyword Note: this field should contain an array of values. example: ["CAP_BPF", "CAP_SYS_ADMIN"]	extended
process.thread.id	Thread ID. type: long example: 4242	extended
process.thread.name	Thread name. type: keyword example: thread-0	extended
process.title	Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. type: keyword Multi-fields: - process.title.text (type: match_only_text) process.title	extended
process.tty	Information about the controlling TTY device. If set, the process belongs to an interactive session. type: object	extended
process.tty.char_device.major	The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. type: long example: 4	extended
process.tty.char_device.minor	The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. type: long example: 1	extended
process.tty.columns	The number of character columns per line. e.g terminal width Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = text_output type: long example: 80	extended
process.tty.rows	The number of character rows in the terminal. e.g terminal height Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = text_output type: long example: 24	extended
process.uptime	Seconds the process has been up. type: long example: 1325 process.uptime	extended
process.vpid	Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within. type: long example: 4242 process.vpid	core
process.working_directory	The working directory of the process. type: keyword Multi-fields: - process.working_directory.text (type: match_only_text) example: /home/alice process.working_directory	extended

The process fields are expected to be nested at:

• process.entry_leader
• process.entry_leader.parent
• process.entry_leader.parent.session_leader
• process.group_leader
• process.parent
• process.parent.group_leader
• process.previous
• process.responsible
• process.session_leader
• process.session_leader.parent
• process.session_leader.parent.session_leader

Note also that the process fields may be used directly at the root of the events.