datafeed_v3_linux_system_process_discovery.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "event.type": "start"
          }
        }
      ],
      "must": [
        {
          "bool": {
            "should": [
              {
                "match": {
                  "host.os.type": {
                    "query": "linux",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.family": {
                    "query": "debian",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.family": {
                    "query": "redhat",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.family": {
                    "query": "suse",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.family": {
                    "query": "ubuntu",
                    "operator": "OR"
                  }
                }
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                "term": {
                  "process.name": "ps"
                }
              },
              {
                "term": {
                  "process.name": "top"
                }
              }
            ]
          }
        }
      ]
    }
  }
}