Use User.Name if User.Username is empty.

elastic · Jan 28, 2019 · 1c0d8f1 · 1c0d8f1
1 parent 22a1b79
commit 1c0d8f1
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go
@@ -287,7 +287,11 @@ func processEvent(process *Process, eventType string, action eventAction) mb.Eve
 	}
 
 	if process.User != nil {
-		event.RootFields.Put("user.name", process.User.Username)
+		if process.User.Username != "" {
+			event.RootFields.Put("user.name", process.User.Username)
+		} else if process.User.Name != "" {
+			event.RootFields.Put("user.name", process.User.Name)
+		}
 	}
 
 	if process.Group != nil {