Add process.command_line to Sysmon module

[webhead404]

Adds the process.command_line field to Sysmon module that does not split the field into multiple values.

-Enhancement

What does this PR do?

Added process.command_line field to sysmon module.

Why is it important?

Previously the only field for the Sysmon module was process.args

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Closes [Winlogbeat] CLI Values to ECS process.command_line #16072

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[cla-checker-service]

💚 CLA has been signed

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[webhead404]

I did sign CLA, looks like the bot hasn't updated status.

[andrewkroh]

Thanks for the contribution!

[andrewkroh]

Check out where this function is called. It's used in two different contexts so hard-coding the target field won't work. I suggest changing the field parameter to be the target namespace. Like this, then update the callers.

var splitCommandLine = function(evt, namespace) {
        var commandLine = evt.Get(field);
        if (!commandLine) {
            return;
        }
        evt.Put(namespace+".args", winlogbeat.splitCommandLine(commandLine));
        evt.Put(namespace+".command_line", commandLine);
}

[andrewkroh]

I opened #17823 to finish the change. It looks like this fork no longer exists.