[Filebeat] journald input - map linux capabilities to ECS

[andrewkroh]

Describe the enhancement:

journald has a _CAP_EFFECTIVE field ¹. This could be used to populate the ECS 8.10 process.thread.capabilities.effective field from the journald input code.

Here is a sample event is export format that contains _CAP_EFFECTIVE: journald.export.txt

Describe a specific use case for the enhancement or feature:

Our software should be aligned to ECS where possible. Formatting the data in the same way makes is possible to uniformly query all processes data that mentions a given Linux capability.

Footnotes

1. https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html#Trusted%20Journal%20Fields ↩

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)