I don't think there are users of this yet, the ECS format expects CAP_FOO, so it makes no sense for us to have a different representation than that one.
As noted in https://github.com/elastic/go-sysinfo/pull/196, this likely never worked meaning we don't have users, the time for change is upon us. This avoids an extra 41*2 allocations for each root process in auditbeat as we would have to convert map the names ourselves.
I don't think there are users of this yet, the ECS format expects CAP_FOO, so it makes no sense for us to have a different representation than that one.
As noted in https://github.com/elastic/go-sysinfo/pull/196, this likely never worked meaning we don't have users, the time for change is upon us. This avoids an extra 41*2 allocations for each root process in auditbeat as we would have to convert map the names ourselves.