{
  "_index": "auditbeat-2020.03.06",
  "_type": "_doc",
  "_id": "IHaAr3ABWAfwH1eDm-zq",
  "_score": 1,
  "_source": {
    "host": {
      "name": "db"
    },
    "process": {
      "working_directory": "/opt/xxx/dbs",
      "name": "oracle_17352_xx",
      "executable": "/opt/xxx/bin/oracle",
      "args": [
        "oracle",
        "(LOCAL=NO)"
      ],
      "entity_id": "DFoCu0ytLk1bYl7J",
      "ppid": 1,
      "start": "2020-03-06T11:00:01.319Z",
      "pid": 17352
    },
    "message": "ERROR for PID 17352: failed to hash executable /opt/xxx/bin/oracle for PID 17352: failed to hash file /opt/xxx/bin/oracle: hasher: file size 407988864 exceeds max file size",
    "event": {
      "kind": "error",
      "action": "process_error",
      "module": "system",
      "dataset": "process"
    },
    "@version": "1",
    "@timestamp": "2020-03-06T11:00:05.073Z",
    "error": {
      "message": "failed to hash executable /opt/xxx/bin/oracle for PID 17352: failed to hash file /opt/xxx/bin/oracle: hasher: file size 407988864 exceeds max file size"
    },
  "fields": {
    "@timestamp": [
      "2020-03-06T11:00:05.073Z"
    ],
    "process.start": [
      "2020-03-06T11:00:01.319Z"
    ]
  }
}

options max_file_size, exclude_files do not give a result. as they refer to the file_integrity module.
The system module does not have options for max_file_size or exclude_files for skipping.

- module: system
  datasets:
    - login   # User logins, logouts, and system boots.
    - package # Installed, updated, and removed packages
    - process # Started and stopped processes
    - user    # User information

  state.period: 12h
  user.detect_password_changes: true
  login.wtmp_file_pattern: /var/log/wtmp*
  login.btmp_file_pattern: /var/log/btmp*