This is cool, would love to have all these events available! Hopefully someone from osquery core can look soon. My high level feedback is I'm not convinced on adding all this to the existing process events table. It feels confusing for the name and adds lots of unnecessary columns to what is already a high number of columns for the existing users of the table (who may be doing select * or similar). I would go towards a new table instead. I don't have much opinion on if the new table should have all the ES events in one place or if it would have just all the new non-process related events added. Code change otherwise looks reasonable at a glance to me, and I believe sharing the code between two similar tables shouldn't be too bad if that's the easiest way to make this work. (context I'm coming from is working on changes to this table in the past, but I'm not an official reviewer or anything, so take my opinion however you'd like 🙂 )

yeah that's a good call

This is a pretty big diff, so I haven’t had a chance to go through it — as Brad suggested, we do want new table, but we would also new es_client so that we are not piggybacking on the current ones