elastic / elastic/integrations

[System]: Add Always Include Processes

Open
#20,109 0 comments 0 reactions 0 assignees View on GitHub
Integration:system needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

System [packages/system]

### Dataset Name

system.process

### Integration Version

2.20.0

### Agent Version

9.2.6

### OS Version and Architecture

Windows Server 2022

### User Goal

Add support for always-include process monitoring alongside existing Top N CPU/Memory process filtering in the System integration (system.process metricset).

Today, when process.include_top_n.by_cpu and/or process.include_top_n.by_memory are configured, process events are limited to the selected Top N processes. This makes it difficult to continuously monitor specific business-critical processes that may consume little CPU or memory for extended periods.

Proposed enhancement:
Introduce a configuration option that allows users to specify one or more processes that should always be reported, regardless of their CPU or memory ranking.
Example:

```
process.include_top_n:
by_cpu: 5
by_memory: 5

process.always_include:
- sw_d.exe
- sqlservr.exe
- my_business_app.exe
```

The resulting process dataset would contain:

- Top N processes by CPU
- Top N processes by memory
- All processes explicitly listed in always_include

while avoiding duplicate events when a process matches both criteria.

### Existing Features

Its either all process, specific process or Top N, which can lead to blind spots.

### What did you see?

N/A

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Begin in packages/system and the system.process metricset, reading the existing process.include_top_n configuration and process-selection behavior. Done means always_include processes are reported alongside the CPU and memory Top N results, with duplicate events avoided when a process matches multiple criteria.

Written by the indexing model from the issue text.

Assessment

Domain
observability-sre, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.