datafeed_rare_process_by_host_linux_ecs.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {"terms": {"event.action": ["process_started", "executed"]}},
          { "term": { "agent.type": "auditbeat" } }

        ]
      }
    }
  }