queue":{"acked":668}}},"msg_file_cache":{"SecurityHits":672},"published_events":{"Security":668,"total":668}}}} 2026-07-12T00:49:01.088+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-07-12T00:49:02.089+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-07-12T00:49:03.117+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:49:04.139+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:49:05.149+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:49:06.161+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:49:07.187+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:49:08.208+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:49:09.224+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:49:10.252+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-07-12T00:49:11.277+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-07-12T00:49:12.284+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:49:13.313+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:49:14.331+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-07-12T00:49:15.327+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 4 events 2026-07-12T00:49:16.359+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:49:18.358+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-07-12T00:49:19.385+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:49:20.405+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:49:21.415+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:49:22.442+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:49:23.450+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-07-12T00:49:24.473+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:49:26.505+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-07-12T00:49:27.509+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:49:28.522+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:49:29.546+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:49:30.555+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:49:31.051+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177281,"time":{"ms":16}},"total":{"ticks":1821202,"time":{"ms":312},"value":1821202},"user":{"ticks":1643921,"time":{"ms":296}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142530618}},"memstats":{"gc_next":5884528,"memory_alloc":4346064,"memory_total":325032296512}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":760,"batches":28,"total":760},"read":{"bytes":168},"write":{"bytes":168626}},"pipeline":{"clients":3,"events":{"active":25,"published":744,"total":744},"queue":{"acked":760}}},"msg_file_cache":{"SecurityHits":744},"published_events":{"Security":760,"total":760}}}} 2026-07-12T00:49:31.573+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:49:32.598+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:49:33.604+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:49:35.642+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 53 events 2026-07-12T00:49:36.647+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:49:37.648+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 4 events 2026-07-12T00:49:38.671+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:49:39.687+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-07-12T00:49:41.698+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:49:42.731+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 51 events 2026-07-12T00:49:43.741+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:49:44.766+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:49:45.774+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:49:46.786+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:49:47.812+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:49:48.817+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-07-12T00:49:50.839+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-07-12T00:49:51.857+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:49:52.864+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:49:54.878+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:49:55.910+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-07-12T00:49:57.941+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 53 events 2026-07-12T00:49:58.944+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:49:59.957+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:50:00.990+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-07-12T00:50:01.049+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177312,"time":{"ms":31}},"total":{"ticks":1821499,"time":{"ms":297},"value":1821499},"user":{"ticks":1644187,"time":{"ms":266}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142560617}},"memstats":{"gc_next":8990000,"memory_alloc":4799056,"memory_total":325095518576}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":710,"batches":25,"total":710},"read":{"bytes":150},"write":{"bytes":156629}},"pipeline":{"clients":3,"events":{"active":8,"published":693,"total":693},"queue":{"acked":710}}},"msg_file_cache":{"SecurityHits":693},"published_events":{"Security":710,"total":710}}}} 2026-07-12T00:50:01.988+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-07-12T00:50:04.004+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:50:05.026+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:50:06.042+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:50:08.062+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-07-12T00:50:09.067+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:50:09.067+0800 INFO beater/eventlogger.go:73 EventLog[Application] successfully published 6 events 2026-07-12T00:50:10.091+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:50:10.091+0800 INFO beater/eventlogger.go:73 EventLog[System] successfully published 4 events 2026-07-12T00:50:10.091+0800 INFO beater/eventlogger.go:73 EventLog[Application] successfully published 4 events 2026-07-12T00:50:11.122+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-07-12T00:50:12.134+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:50:13.150+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:50:14.149+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-07-12T00:50:16.173+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-07-12T00:50:17.186+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-07-12T00:50:18.198+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:50:19.198+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-07-12T00:50:20.232+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-07-12T00:50:21.241+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:50:23.240+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-07-12T00:50:24.263+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:50:25.265+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 9 events 2026-07-12T00:50:27.288+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:50:29.309+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-07-12T00:50:30.334+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-07-12T00:50:31.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177343,"time":{"ms":31}},"total":{"ticks":1821780,"time":{"ms":281},"value":1821780},"user":{"ticks":1644437,"time":{"ms":250}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142590618}},"memstats":{"gc_next":6377184,"memory_alloc":3902752,"memory_total":325152214352}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":582,"batches":23,"total":582},"read":{"bytes":138},"write":{"bytes":137333}},"pipeline":{"clients":3,"events":{"active":25,"published":599,"total":599},"queue":{"acked":582}}},"msg_file_cache":{"ApplicationHits":7,"ApplicationMisses":3,"SecurityHits":585,"SystemHits":3,"SystemMisses":1},"published_events":{"Application":10,"Security":568,"System":4,"total":582}}}} 2026-07-12T00:50:31.346+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:50:33.370+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:50:34.375+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-07-12T00:50:35.380+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-07-12T00:50:36.435+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 75 events 2026-07-12T00:50:37.429+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:50:38.458+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-07-12T00:50:39.479+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:50:40.493+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:50:41.525+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:50:42.539+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-07-12T00:50:44.563+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:50:45.567+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-07-12T00:50:46.599+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-07-12T00:50:47.602+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:50:49.627+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-07-12T00:50:50.635+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:50:51.648+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:50:52.668+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:50:53.671+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:50:55.689+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:50:57.704+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:50:58.737+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-07-12T00:50:59.754+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-07-12T00:51:00.764+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:51:01.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177375,"time":{"ms":32}},"total":{"ticks":1822046,"time":{"ms":266},"value":1822046},"user":{"ticks":1644671,"time":{"ms":234}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142620618}},"memstats":{"gc_next":6194560,"memory_alloc":5158168,"memory_total":325214599240}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":693,"batches":25,"total":693},"read":{"bytes":150},"write":{"bytes":156561}},"pipeline":{"clients":3,"events":{"active":0,"published":668,"total":668},"queue":{"acked":693}}},"msg_file_cache":{"SecurityHits":668},"published_events":{"Security":693,"total":693}}}} 2026-07-12T00:51:02.799+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-07-12T00:51:03.806+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:51:04.813+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:51:05.832+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:51:06.837+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-07-12T00:51:07.852+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:51:08.868+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:51:10.887+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-07-12T00:51:11.916+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-07-12T00:51:12.938+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-07-12T00:51:13.953+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:51:14.984+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 51 events 2026-07-12T00:51:15.995+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:51:17.029+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-07-12T00:51:19.059+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-07-12T00:51:20.063+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:51:21.069+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:51:22.103+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-07-12T00:51:23.123+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:51:24.123+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:51:25.153+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-07-12T00:51:26.162+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:51:27.184+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-07-12T00:51:28.197+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-07-12T00:51:29.203+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-07-12T00:51:30.249+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 63 events 2026-07-12T00:51:31.049+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177453,"time":{"ms":78}},"total":{"ticks":1822499,"time":{"ms":453},"value":1822499},"user":{"ticks":1645046,"time":{"ms":375}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142650617}},"memstats":{"gc_next":9096752,"memory_alloc":5109120,"memory_total":325283624736}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":797,"batches":26,"total":797},"read":{"bytes":156},"write":{"bytes":174942}},"pipeline":{"clients":3,"events":{"active":15,"published":812,"total":812},"queue":{"acked":797}}},"msg_file_cache":{"SecurityHits":812},"published_events":{"Security":797,"total":797}}}} 2026-07-12T00:51:31.248+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-07-12T00:51:32.264+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:51:34.298+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-07-12T00:51:35.305+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:51:36.316+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:51:37.341+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-07-12T00:51:38.357+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:51:39.360+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-07-12T00:51:41.373+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:51:42.399+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-07-12T00:51:43.430+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-07-12T00:51:44.447+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:51:45.471+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:51:46.495+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-07-12T00:51:47.505+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:51:48.525+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:51:49.549+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-07-12T00:51:50.559+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:51:52.565+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-07-12T00:51:53.595+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-07-12T00:51:54.600+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:51:55.608+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-07-12T00:51:56.630+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-07-12T00:51:57.638+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-07-12T00:51:58.662+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-07-12T00:51:59.695+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-07-12T00:52:01.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177546,"time":{"ms":93}},"total":{"ticks":1822874,"time":{"ms":375},"value":1822874},"user":{"ticks":1645328,"time":{"ms":282}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142680618}},"memstats":{"gc_next":5783712,"memory_alloc":3415240,"memory_total":325350367824}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":736,"batches":26,"total":736},"read":{"bytes":156},"write":{"bytes":161627}},"pipeline":{"clients":3,"events":{"active":20,"published":741,"total":741},"queue":{"acked":736}}},"msg_file_cache":{"SecurityHits":741},"published_events":{"Security":736,"total":736}}}} 2026-07-12T00:52:01.701+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:52:02.730+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-07-12T00:52:03.748+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:52:05.754+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:52:06.789+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-07-12T00:52:07.796+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:52:08.846+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 69 events 2026-07-12T00:52:09.847+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:52:10.862+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:52:11.884+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:52:13.882+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 4 events 2026-07-12T00:52:14.909+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:52:15.929+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:52:16.946+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-07-12T00:52:17.958+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:52:18.996+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-07-12T00:52:20.008+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:52:21.020+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:52:22.038+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-07-12T00:52:23.046+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:52:24.062+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:52:26.089+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:52:27.095+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:52:28.111+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:52:29.133+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:52:30.156+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-07-12T00:52:31.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177578,"time":{"ms":32}},"total":{"ticks":1823234,"time":{"ms":360},"value":1823234},"user":{"ticks":1645656,"time":{"ms":328}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142710618}},"memstats":{"gc_next":8870672,"memory_alloc":4891744,"memory_total":325418354440}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":786,"batches":26,"total":786},"read":{"bytes":156},"write":{"bytes":172093}},"pipeline":{"clients":3,"events":{"active":12,"published":778,"total":778},"queue":{"acked":786}}},"msg_file_cache":{"ApplicationSize":-3,"SecurityHits":778,"SystemSize":-1},"published_events":{"Security":786,"total":786}}}} 2026-07-12T00:52:31.157+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-07-12T00:52:32.200+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 55 events 2026-07-12T00:52:33.199+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:52:34.211+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:52:35.237+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:52:36.245+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:52:38.272+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:52:39.282+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-07-12T00:52:40.294+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:52:41.309+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-07-12T00:52:42.314+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-07-12T00:52:44.334+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:52:45.368+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 50 events 2026-07-12T00:52:46.368+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:52:47.409+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 56 events 2026-07-12T00:52:48.415+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-07-12T00:52:49.433+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-07-12T00:52:50.465+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-07-12T00:52:51.466+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:52:52.479+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:52:53.498+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:52:55.513+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:52:56.531+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:52:57.562+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-07-12T00:52:58.566+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-07-12T00:52:59.593+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-07-12T00:53:00.616+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-07-12T00:53:01.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177609,"time":{"ms":31}},"total":{"ticks":1823452,"time":{"ms":218},"value":1823452},"user":{"ticks":1645843,"time":{"ms":187}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142740618}},"memstats":{"gc_next":6341632,"memory_alloc":3309632,"memory_total":325486694312}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":744,"batches":27,"total":744},"read":{"bytes":162},"write":{"bytes":166469}},"pipeline":{"clients":3,"events":{"active":11,"published":743,"total":743},"queue":{"acked":744}}},"msg_file_cache":{"SecurityHits":743},"published_events":{"Security":744,"total":744}}}} 2026-07-12T00:53:01.619+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:53:03.659+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 48 events 2026-07-12T00:53:04.664+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:53:05.672+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-07-12T00:53:06.703+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-07-12T00:53:07.706+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 12 events 2026-07-12T00:53:08.725+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-07-12T00:53:09.769+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 53 events 2026-07-12T00:53:11.782+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:53:12.809+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:53:13.810+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-07-12T00:53:15.828+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-07-12T00:53:16.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-07-12T00:53:17.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-07-12T00:53:18.879+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:53:19.906+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-07-12T00:53:20.917+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-07-12T00:53:22.946+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-07-12T00:53:23.955+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:53:24.971+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:53:25.998+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:53:27.006+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-07-12T00:53:28.015+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-07-12T00:53:29.047+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-07-12T00:53:30.074+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:53:31.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177671,"time":{"ms":62}},"total":{"ticks":1823889,"time":{"ms":437},"value":1823889},"user":{"ticks":1646218,"time":{"ms":375}}},"handles":{"open":322},"info":{"ephemeral_id":"2d2b0e21-2101-4a2a-ac65-3d1a25c0148d","uptime":{"ms":142770618}},"memstats":{"gc_next":8892816,"memory_alloc":4469088,"memory_total":325550279752}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":710,"batches":25,"total":710},"read":{"bytes":150},"write":{"bytes":158551}},"pipeline":{"clients":3,"events":{"active":0,"published":699,"total":699},"queue":{"acked":710}}},"msg_file_cache":{"SecurityHits":699},"published_events":{"Security":710,"total":710}}}} 2026-07-12T00:53:32.093+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:53:33.112+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-07-12T00:53:34.129+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-07-12T00:53:35.138+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:53:36.188+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 53 events 2026-07-12T00:53:37.191+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-07-12T00:53:38.193+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-07-12T00:53:39.219+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-07-12T00:53:40.230+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:53:41.244+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-07-12T00:53:42.288+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 58 events 2026-07-12T00:53:43.287+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-07-12T00:53:44.308+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 33 events 2026-07-12T00:53:45.338+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-07-12T00:53:47.343+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-07-12T00:53:48.365+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-07-12T00:53:49.387+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:53:50.412+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 44 events 2026-07-12T00:53:51.436+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-07-12T00:53:52.448+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-07-12T00:53:53.457+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-07-12T00:53:54.473+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-07-12T00:53:56.505+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-07-12T00:53:57.509+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-07-12T00:53:58.531+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-07-12T00:53:59.544+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-07-12T00:54:00.554+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 18 events 2026-07-12T00:54:01.050+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":177718,"time":{"ms":47}},"total":{"ticks":1824218,"time":{"ms":329},"value":1824218},"user":{"ticks":1646500,"time":{"ms":282}}},"handles":{X )6p¥ÓS‡„¬kÝ <2026-07-13.logX )6Xp¥ÓS‡„¬kÝ€ <2026-07-13.logX )6°p¥Óô­„¬kÝ <2026-07-13.logX )6q¥Óô­„¬kÝ€ <2026-07-13.logX )6`q¥Ó®Ó„¬kÝ <2026-07-13.logX )6¸q¥Ó®Ó„¬kÝ€ <2026-07-13.logX )6r¥Ó®Ó„¬kÝ <2026-07-13.logX )6hr¥Ó®Ó„¬kÝ€ <2026-07-13.logX )6Àr¥Óåù„¬kÝ <2026-07-13.logX )6s¥Óåù„¬kÝ€ <2026-07-13.logX )6ps¥Ó3 …¬kÝ <2026-07-13.logX )6Ès¥Ó3 …¬kÝ€ <2026-07-13.logX )6 t¥Ód'¬kÝ <2026-07-13.logX )6xt¥Ód'¬kÝ€ <2026-07-13.logX )6Ðt¥Ód'¬kÝ <2026-07-13.logX )6(u¥Ó·M¬kÝ€ <2026-07-13.logX )6€u¥Ó·M¬kÝ <2026-07-13.logX )6Øu¥Ó·M¬kÝ€ <2