Starting in version 7.16, this experimental functionality has been removed. You should use the journald input in Filebeat instead.
Elastic Docs ›Journalbeat Reference [7.15] ›Exported fields
« Kubernetes fields Monitor Journalbeat »

Process fieldsedit

Process metadata fields

process.exe

type: alias

alias to: process.executable

« Kubernetes fields Monitor Journalbeat »