elastic / elastic/integrations
[System]: Add Always Include Processes
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
System [packages/system]
### Dataset Name
system.process
### Integration Version
2.20.0
### Agent Version
9.2.6
### OS Version and Architecture
Windows Server 2022
### User Goal
Add support for always-include process monitoring alongside existing Top N CPU/Memory process filtering in the System integration (system.process metricset).
Today, when process.include_top_n.by_cpu and/or process.include_top_n.by_memory are configured, process events are limited to the selected Top N processes. This makes it difficult to continuously monitor specific business-critical processes that may consume little CPU or memory for extended periods.
Proposed enhancement:
Introduce a configuration option that allows users to specify one or more processes that should always be reported, regardless of their CPU or memory ranking.
Example:
```
process.include_top_n:
by_cpu: 5
by_memory: 5
process.always_include:
- sw_d.exe
- sqlservr.exe
- my_business_app.exe
```
The resulting process dataset would contain:
- Top N processes by CPU
- Top N processes by memory
- All processes explicitly listed in always_include
while avoiding duplicate events when a process matches both criteria.
### Existing Features
Its either all process, specific process or Top N, which can lead to blind spots.
### What did you see?
N/A
### Anything else?
_No response_
Contributor guide
Research direction
Begin in packages/system and the system.process metricset, reading the existing process.include_top_n configuration and process-selection behavior. Done means always_include processes are reported alongside the CPU and memory Top N results, with duplicate events avoided when a process matches multiple criteria.
Written by the indexing model from the issue text.
Assessment
- Domain
- observability-sre, operating-systems
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100