libbeat/processors/add_process_metadata: fix environment collection (#…

…36471)

Previously, the go-sysinfo types.Process was not being queried for its
environment value if it existed. This is conditionally available
depending on platform, so check and add it if it is.

CHANGELOG.next.asciidoc

@@ -62,7 +62,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Eliminate cloning of event in deepUpdate {pull}35945[35945]
 - Fix ndjson parser to store JSON fields correctly under `target` {issue}29395[29395]
 - Support build of projects outside of beats directory {pull}36126[36126]
-
+- Fix environment capture by `add_process_metadata` processor. {issue}36469[36469] {pull}36471[36471]
 
 
 *Auditbeat*

libbeat/processors/add_process_metadata/add_process_metadata_test.go

@@ -21,6 +21,8 @@ import (
 	"errors"
 	"math"
 	"os"
+	"runtime"
+	"strings"
 	"testing"
 	"time"
 	"unsafe"
@@ -819,9 +821,10 @@ func TestUsingCache(t *testing.T) {
 	}
 
 	config, err := conf.NewConfigFrom(mapstr.M{
-		"match_pids":     []string{"system.process.ppid"},
-		"include_fields": []string{"container.id"},
-		"target":         "meta",
+		"match_pids":        []string{"system.process.ppid"},
+		"include_fields":    []string{"container.id", "process.env"},
+		"target":            "meta",
+		"restricted_fields": true,
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -853,6 +856,24 @@ func TestUsingCache(t *testing.T) {
 	}
 	assert.Equal(t, "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1", containerID)
 
+	// check environment for GOOSes that support it.
+	switch runtime.GOOS {
+	case "darwin", "linux":
+		env, err := result.Fields.GetValue("meta.process.env")
+		if err != nil {
+			t.Fatal(err)
+		}
+		// The event is for this process, so we can just grab our env to compare.
+		want := make(map[string]string)
+		for _, kv := range os.Environ() {
+			k, v, ok := strings.Cut(kv, "=")
+			if ok {
+				want[k] = v
+			}
+		}
+		assert.Equal(t, want, env)
+	}
+
 	ev = beat.Event{
 		Fields: mapstr.M{
 			"system": mapstr.M{

libbeat/processors/add_process_metadata/gosysinfo_provider.go

@@ -28,8 +28,7 @@ import (
 type gosysinfoProvider struct{}
 
 func (p gosysinfoProvider) GetProcessMetadata(pid int) (result *processMetadata, err error) {
-	var proc types.Process
-	proc, err = sysinfo.Process(pid)
+	proc, err := sysinfo.Process(pid)
 	if err != nil {
 		return nil, err
 	}
@@ -40,6 +39,11 @@ func (p gosysinfoProvider) GetProcessMetadata(pid int) (result *processMetadata,
 		return nil, err
 	}
 
+	var env map[string]string
+	if e, ok := proc.(types.Environment); ok {
+		env, _ = e.Environment()
+	}
+
 	username, userid := "", ""
 	if userInfo, err := proc.User(); err == nil {
 		userid = userInfo.UID
@@ -51,6 +55,7 @@ func (p gosysinfoProvider) GetProcessMetadata(pid int) (result *processMetadata,
 	r := processMetadata{
 		name:      info.Name,
 		args:      info.Args,
+		env:       env,
 		title:     strings.Join(info.Args, " "),
 		exe:       info.Exe,
 		pid:       info.PID,