Add PIDs by default

[spyder-kyle]

Motivation

The default rules lack a unique identifier for the processes that cause events, making it impossible to merge information with other sources in many cases.

Feature

Adding pid=%proc.pid to the output of all the default rules would be perfect. I could easily create a PR for this if necessary.

Alternatives

One could override all the rules and specify PIDs, or append to all their outputs if that functionality is added, but the number of default rules makes either option not appealing.

Additional context

[jasondellaluce]

@spyder-kyle I would suggest opening a PR with the proposed changes and move the discussion there