new filter fields: proc.cmdline and evt.io_dir