datafeed_docker_high_count_process_events_ecs.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "query": {
    "bool": {
      "filter": [
        { "term":  { "event.module": "auditd" } },
        { "term":  { "container.runtime": "docker" } }
      ],
      "must": {
        "exists": { "field": "auditd.data.syscall" }
      }
    }
  }
}