I had a question about process eventing for the container and its traceability. I am able to get process eventing from the host for a short lived process launched inside the container. But based on the log, I don't see any info that traces this process to the parent container. This is a sample output that the log captured.

{
  "name": "process_events",
  "hostIdentifier": "<host id>",
  "calendarTime": "Thu Apr 30 06:26:50 2020 UTC",
  "unixTime": 1588228010,
  "epoch": 0,
  "counter": 0,
  "numerics": false,
  "columns": {
    "atime": "0",
    "auid": "3297937405",
    "btime": "0",
    "cmdline": "sh -c ping <http://google.com|google.com>",
    "ctime": "0",
    "cwd": "\"/test\"",
    "egid": "0",
    "euid": "0",
    "gid": "0",
    "mode": "0100755",
    "mtime": "0",
    "owner_gid": "0",
    "owner_uid": "0",
    "parent": "9734",
    "path": "/usr/bin/bash",
    "pid": "9735",
    "syscall": "execve",
    "time": "1588228008",
    "uid": "0",
    "uptime": "14185"
  },
  "action": "added"
}

My question is: how do I trace this info back to the parent container? I am aware that the associated info may be available from docker_xxx tables or I could traverse parent pid but I believe this info should be captured in the event log itself to avoid ambiguity (shortlived parent processes and pid collision across namespaces)