Common Fields for Process Inventory Schema

[kaiyan-sheng]

This is a meta issue to track the work related to defining the common fields for process inventory schema. We would like to have a set of required and recommended fields to be added to any event related to a process. The main focus is on Metricbeat system module process metricsets. There are also other modules in Metricbeat that reports metrics related to different processes, such as php_fpm, haproxy and mongodb.

Link to current process fields in ECS: https://www.elastic.co/guide/en/ecs/master/ecs-process.html

TODO:

• System process metricset already reports some of the process ECS fields. But there is one field system.process.cmdline should use process.command_line instead. (Duplicate system.process.cmdline field with process.command_line ECS field name #22325)

Proposed Common Fields:

• process.command_line
• process.cpu.pct
• process.cpu.start_time
• process.memory.pct
• process.pid
• process.state

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[kaiyan-sheng]

Not sure if the list below should be a part of this exercise:

• haproxy.info.uptime.sec should use process.uptime instead

• mongodb.status.uptime.ms should convert to second and use process.uptime instead

• redis.info.server.uptime should use process.uptime instead (check unit first)

• system.socket.process.cmdline should use process.command_line instead

[fearful-symmetry]

Using process.command_line definitely makes sense. I kind of worry though if the others are maybe bending the definition of "process" a bit, particularly if a user can't map the rest of that data to a given PID.

[kaiyan-sheng]

Thanks @fearful-symmetry. Good point, the metrics above from haproxy and redis report process.pid as well. But mongodb for example reports process.name.

Also for Kibana metrics UI, we are only gonna focus on system.process fields. We can ignore the fields in the previous comment for now.

[kaiyan-sheng]

Fields used in process metrics UI:

• process.command_line
• process.pid
• system.process.state
• user.name
• system.process.cpu.total.norm.pct
• system.process.cpu.start_time
• system.process.memory.rss.pct

[kaiyan-sheng]

It would be good to have process.ppid so metrics UI process tab can display a tree map between processes.