[Filebeat] Crowdstrike ingest pipeline wrongly creates process flattened fields.

[leandrojmp]

The Crowdstrike ingest pipeline has a script processor that creates the fields process.command_line, process.args and process.executable as flattened fields, with a dot in the name.

A secondary pipeline processor creates the fields process.pid, process.parent and process.name as nested fields.

The final document would have the following output for these fields:

{
    "process.args": "value for the field",
    "process.command_line": "value for the field",
    "process.executable": "value for the field",
    "process": {
        "name": "value for the field",
        "pid": "value for the field",
        "parent": {
            "executable": "value for the field",
            "command_line": "value for the field"
        }
    }
}

This is confusing and could lead to errors in queries or automated processes that expects that the fields args, command_line and executable to be nested inside the process object.

This is the expected output:

{
    "process": {
        "args": "value for the field",
        "command_line": "value for the field",
        "executable": "value for the field",
        "name": "value for the field",
        "pid": "value for the field",
        "parent": {
            "executable": "value for the field",
            "command_line": "value for the field"
        }
    }
}

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)