[filebeat] fix crowdstrike ingest pipeline (#27623)

* fix: fix crowdstrike ingest pipeline

fix process fields that were being created as flattened fields

* docs: add line to changelog.next

added line about the pr in the changelog.next file

* docs: add links in changelog

corrected the links to the issue and pr in changelog

* Update CHANGELOG.next.asciidoc

Fixed capitalization.

CHANGELOG.next.asciidoc

@@ -82,6 +82,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - threatintel module: Changed the type of `threatintel.indicator.first_seen` from `keyword` to `date`. {pull}26765[26765]
 - Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627]
 - Add option for S3 input to work without SQS notification {issue}18205[18205] {pull}27332[27332]
+- Fix Crowdstrike ingest pipeline that was creating flattened `process` fields. {issue}27622[27622] {pull}27623[27623]
 
 *Heartbeat*
 - Remove long deprecated `watch_poll` functionality. {pull}27166[27166]

x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml

@@ -284,9 +284,10 @@ processors:
             def args = Arrays.asList(/ /.split(commandLine));
             args.removeIf(arg -> arg == "");
 
-            ctx["process.command_line"] = commandLine;
-            ctx["process.args"] = args;
-            ctx["process.executable"] = args.get(0);
+            ctx['process'] = new HashMap();
+            ctx.process.command_line = commandLine;
+            ctx.process.args = args;
+            ctx.process.executable = args.get(0);
           }
         }
   - pipeline: