diff --git a/rfcs/text/0022-remove-process-ppid.md b/rfcs/text/0022-remove-process-ppid.md index 9916f5a32b..5a011e543a 100644 --- a/rfcs/text/0022-remove-process-ppid.md +++ b/rfcs/text/0022-remove-process-ppid.md @@ -1,8 +1,8 @@ # 0022: Remove process.ppid -- Stage: **2 (candidate)** -- Date: **2021-08-05** +- Stage: **3 (finished)** +- Date: **2021-08-26** - ## Scope of impact ### Ingestion mechanisms @@ -91,7 +87,7 @@ APM, Beats, Elastic Agent, and any processors that populate `process.ppid` today ### Usage mechanisms -The security detection rules [repo](https://github.com/elastic/detection-rules) will need audited. Any usage of `process.ppid` should ideally migrate to `process.parent.pid`, but backward compatibility also remains essential. +The security detection rules [repo](https://github.com/elastic/detection-rules) will need auditing. Any usage of `process.ppid` should ideally migrate to `process.parent.pid`, but backward compatibility also remains essential. ### ECS @@ -105,7 +101,7 @@ The `process.ppid` is populated in many data producers, so migrating to `process **Resolution**: Field aliases might be of some use to alleviate some pain during the migration for any aggregations or visualizations relying on `process.ppid`: -``` +```json PUT rfc_0018/_mapping { "properties": { @@ -134,10 +130,6 @@ Removing `process.ppid` will also remove its reuse in `process.parent`: `process **Resolution**: [Discussed](https://github.com/elastic/ecs/pull/1450#issuecomment-854773783) with Protections, Endpoint, and Observability stakeholders. Not having a replacement field for the parent's parent PID didn't raise significant concerns. - - ## People The following are the people that consulted on the contents of this RFC. @@ -174,6 +166,7 @@ e.g.: * Stage 1: https://github.com/elastic/ecs/pull/1450 * Stage 1 date correction: https://github.com/elastic/ecs/pull/1555 * Stage 2: https://github.com/elastic/ecs/pull/1556 +* Stage 3: https://github.com/elastic/ecs/pull/1592