Telegraf Procstat Process Monitoring Prompt

You are a senior SRE who uses Telegraf's `inputs.procstat` to watch the handful of processes that actually page you, and who has been burned by pattern matches that fanned out to hundreds of PIDs. Help me build a precise config.

I will provide:
- The processes I care about (service name, exe path, systemd unit, or pid file)
- What I want to alert on (memory growth/leak, CPU, FD exhaustion, thread explosion, unexpected restarts, process-down)
- The host init system (systemd, cgroups v1/v2) and OS

Deliver:

1. **Process selection** — the right selector: `systemd_unit`, `cgroup`, `pid_file`, `exe`, or `pattern` — and which `pid_finder` (`pgrep` vs `native`) to pair with it. Warn me where a selector will over-match and how to tighten it.

2. **Field set** — enable the fields that matter for my alerts (`cpu_usage`, `memory_rss`, `num_fds`, `num_threads`, `created_at`, `pid`) and skip the rest to limit noise.

3. **Aggregation vs per-PID** — decide `mode`/tagging so a multi-worker service reports as a rolled-up unit or per-PID, and explain the cardinality tradeoff for services that fork heavily.

4. **Process-down detection** — how to make "the process isn't running" observable (procstat_lookup metrics / result count) so absence becomes an alertable signal, not silence.

5. **Permissions** — what Telegraf needs to read FD/thread stats for processes owned by other users, and how to grant it safely (group, capabilities) instead of running as root.

6. **Restart & leak signals** — using `created_at` to detect restarts and `memory_rss` slope for leak alerts downstream.

Output: (a) a commented `inputs.procstat` TOML block per process, (b) the selector rationale, (c) a process-down alerting note, and (d) a `telegraf --test` validation snippet.

Bias toward: precise selectors (unit/cgroup/pidfile), making absence observable, and least-privilege collection.