diff --git a/auditbeat/_meta/fields.common.yml b/auditbeat/_meta/fields.common.yml index 46c30ef32709..4ae66bfa4211 100644 --- a/auditbeat/_meta/fields.common.yml +++ b/auditbeat/_meta/fields.common.yml @@ -66,7 +66,7 @@ description: Process command. - name: pid - type: integer + type: long description: PID. - name: user.id diff --git a/auditbeat/module/file_integrity/event.go b/auditbeat/module/file_integrity/event.go index e1aceccc938c..20cfc6939ffa 100644 --- a/auditbeat/module/file_integrity/event.go +++ b/auditbeat/module/file_integrity/event.go @@ -135,7 +135,6 @@ type Event struct { Hashes map[HashType]Digest `json:"hash,omitempty"` // File hashes. ParserResults mapstr.M `json:"file,omitempty"` // Results from running file parsers. Process *Process `json:"process,omitempty"` // Process data. Available only on Linux when using the eBPF backend. - // TODO(matt): ContainerID string `json:"container_id,omitempty"` // Unique container ID. Available only on Linux when using the eBPF backend. // Metadata rtt time.Duration // Time taken to collect the info.