CPID

Analytics Networking

Synopsis

Generates a CPID (Common Process ID) according to RFC 9562.

Schema

- cpid:
    hostname_field: <ident>
    process_id_field: <ident>
    time_field: <ident>
    target_field: <ident>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
hostname_field	Y	-	Field containing the hostname or system identifier
process_id_field	Y	-	Field containing the process ID
time_field	Y	-	Field containing the process creation time
target_field	N	process.common_id	Field where the generated CPID will be stored
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if generation fails
ignore_missing	N	false	Continue if source fields don't exist (uses empty values)
on_failure	N	-	Error handling processors
on_success	N	-	Success handling processors
tag	N	-	Identifier for logging

Details

Generates a Common Process ID (CPID) according to RFC 9562, providing a consistent way to identify unique process instances across systems and log sources. The processor creates a UUID (Version 8, Variant 1) by combining hostname, process ID, and time information.

note

When using ignore_missing: true, missing time values will be replaced with the current processing time, while missing hostname or process ID values will be treated as empty strings.

The processor ensures that the same process instance will have the same identifier across different log entries and sources, enabling correlation and tracking of process activity throughout its lifecycle.

warning

The CPID algorithm uses SHA-256 hashing to generate consistent identifiers. For optimal correlation, ensure that the input fields contain stable and consistent values across log sources.

Examples

Basic CPID Generation

Generating a CPID from standard fields...	{ "host": { "name": "web-server-01" }, "process": { "pid": 1234, "created_at": "2023-06-15T10:30:45Z" } } - cpid: hostname_field: host.name process_id_field: process.pid time_field: process.created_at
creates a standardized process ID:	{ "host": { "name": "web-server-01" }, "process": { "pid": 1234, "created_at": "2023-06-15T10:30:45Z", "common_id": "df26e15c-8c14-824b-89d2-e3f1a79f29a6" } }

Custom Target Field

Storing CPID in a custom field...	{ "system": "database-01", "proc_info": { "id": 5678, "start_time": "2023-07-10T08:15:22Z" } } - cpid: hostname_field: system process_id_field: proc_info.id time_field: proc_info.start_time target_field: proc_info.uuid
with custom field placement:	{ "system": "database-01", "proc_info": { "id": 5678, "start_time": "2023-07-10T08:15:22Z", "uuid": "7a3b9c4d-8e2f-8156-9a7b-c5d3e2f1a9b8" } }

Handling Missing Fields

Continuing processing despite missing fields...	{ "host": "app-server-05", "process": { "id": 9012 } } - cpid: hostname_field: host process_id_field: process.id time_field: process.created ignore_missing: true
generates CPID with available information:	{ "host": "app-server-05", "process": { "id": 9012, "common_id": "6f8e7d6c-5b4a-8372-9c8b-7a6b5c4d3e2f" } }