The field process.command_line needs to be keyword type for EQL threat detection example

[ywangd]

The doc page has the following query example:

GET /my-index-000001/_eql/search
{
  "query": """
    process where process.name == "regsvr32.exe" and process.command_line != null
  """
}

However the process.command_line field must be of keyword type for the above query to work. Otherwise, you'll get back an illegal_argument_exception. The doc test has this configuration in its build.gradle file so it works on CI. But the doc itself does not mention this. If an user just follow the documentation by straightaway bulk indexing the provided JSON file, he/she will encounter error at the above query.

[elasticmachine]

Pinging @elastic/es-ql (:Query Languages/EQL)

[elasticmachine]

Pinging @elastic/es-docs (>docs)