Seems like the process ID should be a field not a tag, in order to reduce series cardinality. I'm not sure I see a compelling use case for GROUP BY pid, given that over time each process name could generate over 32000 series. If pid was a field it would still be possible to search for a specific PID, although regex doesn't work on fields.