diff --git a/metric/system/process/process.go b/metric/system/process/process.go
index 06af0f1f6b..b74356a920 100644
--- a/metric/system/process/process.go
+++ b/metric/system/process/process.go
@@ -122,7 +122,7 @@ func (procStats *Stats) Get() ([]mapstr.M, []mapstr.M, error) {
 		// Add the RSS pct memory first
 		process.Memory.Rss.Pct = GetProcMemPercentage(process, totalPhyMem)
 		// Create the root event
-		rootMap := processRootEvent(process)
+		rootMap := processRootEvent(&process)
 
 		proc, err := procStats.getProcessEvent(&process)
 		if err != nil {
@@ -163,7 +163,7 @@ func (procStats *Stats) GetOneRootEvent(pid int) (mapstr.M, mapstr.M, error) {
 		return nil, nil, fmt.Errorf("error formatting process %d: %w", pid, err)
 	}
 
-	rootMap := processRootEvent(pidStat)
+	rootMap := processRootEvent(&pidStat)
 
 	return procMap, rootMap, err
 }
diff --git a/metric/system/process/process_common.go b/metric/system/process/process_common.go
index 29bce386b3..7427c39912 100644
--- a/metric/system/process/process_common.go
+++ b/metric/system/process/process_common.go
@@ -211,7 +211,7 @@ func (procStats *Stats) Init() error {
 }
 
 // processRootEvent formats the process state event for the ECS root fields used by the system/process metricsets
-func processRootEvent(process ProcState) mapstr.M {
+func processRootEvent(process *ProcState) mapstr.M {
 	// Create the root event
 	root := process.FormatForRoot()
 	rootMap := mapstr.M{}
diff --git a/metric/system/process/process_test.go b/metric/system/process/process_test.go
index 0ee589e044..f5d40db2e3 100644
--- a/metric/system/process/process_test.go
+++ b/metric/system/process/process_test.go
@@ -42,6 +42,22 @@ import (
 	"github.com/elastic/elastic-agent-system-metrics/metric/system/resolve"
 )
 
+func TestProcessEvent(t *testing.T) {
+	proc := ProcState{Args: []string{"-b", "-c"},
+		Name:     "test",
+		Username: "user",
+		Memory:   ProcMemInfo{Rss: MemBytePct{Pct: opt.FloatWith(4.5)}},
+	}
+
+	root := processRootEvent(&proc)
+
+	require.Empty(t, proc.Name)
+	require.Empty(t, proc.Username)
+	require.Empty(t, proc.Args)
+
+	require.NotNil(t, root["process"].(map[string]interface{})["memory"])
+}
+
 // BenchmarkGetProcess runs a benchmark of the GetProcess method with caching
 // of the command line and environment variables.
 func BenchmarkGetProcess(b *testing.B) {