👋 Hey I have a couple questions about

process_events

table. I'm running (simplified) this query in a pack:

SELECT pid, parent FROM process_events

. What I expected in json logs (with most fields removed):

{
  "columns": {
    "pid": 9999,
    "parent": 5555
  },
  ...
}

The schema docs (https://osquery.io/schema/4.2.0) say that

parent

should return PPID, or -1 if it cannot be determined. Two questions: 1. Under what scenario(s) would PPID not be able to be determined? 2. I would expect to see

"parent": -1

in logs, but instead I'm seeing

"parent": ""

(null value). Based on the docs, this seems like a bug to me. Is there an explanation for that?