diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index f5252af0951..0ae97dd2033 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -82,6 +82,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - threatintel module: Changed the type of `threatintel.indicator.first_seen` from `keyword` to `date`. {pull}26765[26765]
 - Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627]
 - Add option for S3 input to work without SQS notification {issue}18205[18205] {pull}27332[27332]
+- Fix Crowdstrike ingest pipeline that was creating flattened `process` fields. {issue}27622[27622] {pull}27623[27623]
 
 *Heartbeat*
 - Remove long deprecated `watch_poll` functionality. {pull}27166[27166]
diff --git a/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml b/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml
index 7e7efe5cd74..9aeb653b488 100644
--- a/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml
+++ b/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml
@@ -284,9 +284,10 @@ processors:
             def args = Arrays.asList(/ /.split(commandLine));
             args.removeIf(arg -> arg == "");
 
-            ctx["process.command_line"] = commandLine;
-            ctx["process.args"] = args;
-            ctx["process.executable"] = args.get(0);
+            ctx['process'] = new HashMap();
+            ctx.process.command_line = commandLine;
+            ctx.process.args = args;
+            ctx.process.executable = args.get(0);
           }
         }
   - pipeline: