Sysmon Ingest Pipeline Issue with ProcessId

[El-Reno]

I've noticed that Sysmon event logs are not properly renaming Process IDs from winlog.event_data.ProcessId. Looking at the Elasticsearch ingest file for Sysmon, the ingest does not correctly identify the true Sysmon field. The ingest pipeline is looking for ProcessID and processID. The correct Sysmon field should be ProcessId. Adding the following line after the last ProcessID line in sysmon ingest corrects the issue:
{ "rename": { "field": "winlog.event_data.ProcessId", "target_field": "process.pid", "ignore_missing": true } }

[weslambert]

We'll take a look at this - thanks!

[defensivedepth]

Just merged in this fix, thanks for pointing this out!

#1954

[El-Reno]

No problem! Thank you guys for making an awesome product!