Starting in version 7.16, this experimental functionality has been removed. You should use the journald input in Filebeat instead.
Elastic Docs› Journalbeat Reference [7.15]› Exported fields
« Kubernetes fields Monitor Journalbeat »

Process fieldsedit

Process metadata fields

process.exe

type: alias

alias to: process.executable

« Kubernetes fields Monitor Journalbeat »