add_process_metadata can't create ECS-compliant parent fields

[adriansr]

A common usage of the add_process_metadata processor:

- add_process_metadata:
      match_pids: [some_ppid_field]
      target: process.parent

One would expect that the following fields are created:

"process": {
  "parent": {
    "pid": "1234"
    "name": "parent_process",
    [...]
  }
}

However, the add_process_metadata processor always nests fields in a "process" group inside the given target:

"process": {
  "parent": {
    "process": {
      "pid": "1234"
      "name": "parent_process",
      [...]
    }
  }
}

... which leads to non-ECS compliant fields process.parent.process.name instead of process.parent.name.

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)