,"total":788},"read":{"bytes":150},"write":{"bytes":168003}},"pipeline":{"clients":3,"events":{"active":27,"published":781,"total":781},"queue":{"acked":788}}},"msg_file_cache":{"ApplicationHits":7,"ApplicationMisses":3,"ApplicationSize":-1,"SecurityHits":767,"SystemHits":3,"SystemMisses":1},"published_events":{"Application":10,"Security":774,"System":4,"total":788}}}}
2026-05-11T14:39:57.926+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-11T14:39:58.955+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 47 events
2026-05-11T14:39:59.961+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-11T14:40:00.988+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 40 events
2026-05-11T14:40:02.011+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-11T14:40:03.007+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-11T14:40:04.045+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 56 events
2026-05-11T14:40:05.052+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-11T14:40:06.072+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-11T14:40:08.111+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 59 events
2026-05-11T14:40:09.115+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-11T14:40:10.128+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:40:11.142+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-11T14:40:12.143+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 6 events
2026-05-11T14:40:13.163+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 31 events
2026-05-11T14:40:14.185+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 37 events
2026-05-11T14:40:16.194+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 13 events
2026-05-11T14:40:17.216+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-11T14:40:18.228+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:40:19.240+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-11T14:40:20.266+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 39 events
2026-05-11T14:40:22.288+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 39 events
2026-05-11T14:40:23.301+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-11T14:40:24.333+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 52 events
2026-05-11T14:40:25.332+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 15 events
2026-05-11T14:40:26.354+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-11T14:40:27.161+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":216828,"time":{"ms":16}},"total":{"ticks":2150249,"time":{"ms":344},"value":2150249},"user":{"ticks":1933421,"time":{"ms":328}}},"handles":{"open":320},"info":{"ephemeral_id":"2f4cc43f-b284-4b31-88f0-2d51324049a2","uptime":{"ms":176280369}},"memstats":{"gc_next":5959648,"memory_alloc":3040120,"memory_total":399135470840,"rss":28672}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":794,"batches":26,"total":794},"read":{"bytes":156},"write":{"bytes":170737}},"pipeline":{"clients":3,"events":{"active":28,"published":795,"total":795},"queue":{"acked":794}}},"msg_file_cache":{"SecurityHits":795},"published_events":{"Security":794,"total":794}}}}
2026-05-11T14:40:27.369+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-11T14:40:28.374+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-11T14:40:29.403+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-11T14:40:30.405+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 13 events
2026-05-11T14:40:32.407+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1 events
2026-05-11T14:40:33.435+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-11T14:40:34.452+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-11T14:40:36.470+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-11T14:40:37.472+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 13 events
2026-05-11T14:40:38.506+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 50 events
2026-05-11T14:40:39.533+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 49 events
2026-05-11T14:40:40.538+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:40:41.544+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-11T14:40:42.580+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 50 events
2026-05-11T14:40:43.578+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-11T14:40:44.598+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 31 events
2026-05-11T14:40:46.642+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 50 events
2026-05-11T14:40:47.651+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-11T14:40:48.662+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-11T14:40:49.697+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 48 events
2026-05-11T14:40:50.716+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-11T14:40:51.732+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-11T14:40:52.752+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 34 events
2026-05-11T14:40:54.761+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-11T14:40:55.797+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-11T14:40:56.792+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 6 events
2026-05-11T14:40:57.162+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":216843,"time":{"ms":15}},"total":{"ticks":2150546,"time":{"ms":297},"value":2150546},"user":{"ticks":1933703,"time":{"ms":282}}},"handles":{"open":320},"info":{"ephemeral_id":"2f4cc43f-b284-4b31-88f0-2d51324049a2","uptime":{"ms":176310370}},"memstats":{"gc_next":6386368,"memory_alloc":5127976,"memory_total":399201304424,"rss":53248}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":743,"batches":26,"total":743},"read":{"bytes":156},"write":{"bytes":159911}},"pipeline":{"clients":3,"events":{"active":8,"published":723,"total":723},"queue":{"acked":743}}},"msg_file_cache":{"SecurityHits":723},"published_events":{"Security":743,"total":743}}}}
2026-05-11T14:40:57.796+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-11T14:40:58.832+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 48 events
2026-05-11T14:40:59.842+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-11T14:41:00.850+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-11T14:41:01.876+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-11T14:41:02.892+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-11T14:41:03.900+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-11T14:41:04.941+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 55 events
2026-05-11T14:41:06.953+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 33 events
2026-05-11T14:41:07.960+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-11T14:41:08.996+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 39 events
2026-05-11T14:41:10.019+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 50 events
2026-05-11T14:41:11.025+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:41:12.043+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-11T14:41:13.046+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-11T14:41:14.062+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:41:16.088+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 41 events
2026-05-11T14:41:17.092+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-11T14:41:18.109+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-11T14:41:19.127+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-11T14:41:20.141+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-11T14:41:21.153+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-11T14:41:24.171+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-11T14:41:25.195+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 37 events
2026-05-11T14:41:26.205+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-11T14:41:27.161+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":216890,"time":{"ms":47}},"total":{"ticks":2150874,"time":{"ms":328},"value":2150874},"user":{"ticks":1933984,"time":{"ms":281}}},"handles":{"open":320},"info":{"ephemeral_id":"2f4cc43f-b284-4b31-88f0-2d51324049a2","uptime":{"ms":176340369}},"memstats":{"gc_next":8860400,"memory_alloc":7973992,"memory_total":399264947624}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":680,"batches":25,"total":680},"read":{"bytes":150},"write":{"bytes":148680}},"pipeline":{"clients":3,"events":{"active":29,"published":701,"total":701},"queue":{"acked":680}}},"msg_file_cache":{"SecurityHits":701},"published_events":{"Security":680,"total":680}}}}
2026-05-11T14:41:27.227+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-11T14:41:28.232+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:41:29.242+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-11T14:41:30.285+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 55 events
2026-05-11T14:41:31.287+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-11T14:41:32.298+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-11T14:41:33.312+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:41:35.339+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 38 events
2026-05-11T14:41:37.349+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-11T14:41:38.353+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 10 events
2026-05-11T14:41:40.397+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 62 events
2026-05-11T14:41:41.413+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-11T14:41:42.410+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-11T14:41:43.449+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-11T14:41:45.461+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-11T14:41:46.481+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-11T14:41:47.502+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 40 events
2026-05-11T14:41:48.501+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-11T14:41:50.533+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-11T14:41:51.550+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-11T14:41:52.558+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-11T14:41:53.588+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 44 events
2026-05-11T14:41:54.589+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-11T14:41:55.624+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 53 events
2026-05-11T14:41:56.621+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-11T14:41:57.161+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":216953,"time":{"ms":63}},"total":{"ticks":2151156,"time":{"ms":282},"value":2151156},"user":{"ticks":1934203,"time":{"ms":219}}},"handles":{"open":320},"info":{"ephemeral_id":"2f4cc43f-b284-4b31-88f0-2d51324049a2","uptime":{"ms":176370369}},"memstats":{"gc_next":9006608,"memory_alloc":6444456,"memory_total":399329043480,"rss":4096}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":745,"batches":25,"total":745},"read":{"bytes":150},"write":{"bytes":158817}},"pipeline":{"clients":3,"events":{"active":1,"published":717,"total":717},"queue":{"acked":745}}},"msg_file_cache":{"ApplicationSize":-3,"SecurityHits":717,"SystemSize":-1},"published_events":{"Security":745,"total":745}}}}
2026-05-11T14:41:57.621+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1 events
2026-05-11T14:41:59.645+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-11T14:42:00.661+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-11T14:42:01.674+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-11T14:42:02.689+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-11T14:42:04.706+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-11T14:42:05.720+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-11T14:42:06.748+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 38 events
2026-05-11T14:42:07.753+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-11T14:42:08.783+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-11T14:42:09.783+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-11T14:42:10.819+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 48 events
2026-05-11T14:42:11.834+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 36 events
2026-05-11T14:42:12.855+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-11T14:42:13.862+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-11T14:42:14.874+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-11T14:42:15.902+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-11T14:42:16.912+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-11T14:42:17.912+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 5 events
2026-05-11T14:42:18.929+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:42:19.944+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-11T14:42:20.952+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-11T14:42:21.982+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 43 events
2026-05-11T14:42:22.987+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-11T14:42:25.004+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:42:26.016+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-11T14:42:27.042+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 38 events
2026-05-11T14:42:27.161+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":216984,"time":{"ms":31}},"total":{"ticks":2151484,"time":{"ms":328},"value":2151484},"user":{"ticks":1934500,"time":{"ms":297}}},"handles":{"open":320},"info":{"ephemeral_id":"2f4cc43f-b284-4b31-88f0-2d51324049a2","uptime":{"ms":176400369}},"memstats":{"gc_next":6283344,"memory_alloc":3697056,"memory_total":399396231928}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":696,"batches":27,"total":696},"read":{"bytes":162},"write":{"bytes":154870}},"pipeline":{"clients":3,"events":{"active":16,"published":711,"total":711},"queue":{"acked":696}}},"msg_file_cache":{"SecurityHits":711},"published_events":{"Security":696,"total":696}}}}
2026-05-11T14:42:28.