:06:37.554+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1604 events
2026-05-26T17:06:37.826+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1396 events
2026-05-26T17:06:38.584+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1704 events
2026-05-26T17:06:39.621+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:06:40.663+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:06:41.649+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:06:42.680+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:06:49.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158250,"time":{"ms":344}},"total":{"ticks":1954859,"time":{"ms":7375},"value":1954859},"user":{"ticks":1796609,"time":{"ms":7031}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98820665}},"memstats":{"gc_next":35375360,"memory_alloc":22531456,"memory_total":285230942824}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":16300,"batches":10,"total":16300},"read":{"bytes":66},"write":{"bytes":1981776}},"pipeline":{"clients":3,"events":{"active":4117,"published":16300,"total":16300},"queue":{"acked":16300}}},"msg_file_cache":{"SecurityHits":16300},"published_events":{"Security":16300,"total":16300}}}}
2026-05-26T17:07:13.340+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50618->172.18.8.249:5044: i/o timeout
2026-05-26T17:07:13.342+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50618->172.18.8.249:5044: i/o timeout
2026-05-26T17:07:13.342+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50618->172.18.8.249:5044: i/o timeout
2026-05-26T17:07:13.387+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: client is not connected
2026-05-26T17:07:13.387+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:07:13.388+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:07:15.363+0800	ERROR	pipeline/output.go:121	Failed to publish events: client is not connected
2026-05-26T17:07:15.363+0800	INFO	pipeline/output.go:95	Connecting to backoff(async(tcp://172.18.8.249:5044))
2026-05-26T17:07:15.363+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:07:15.363+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:07:15.363+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:07:15.363+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:07:15.364+0800	INFO	pipeline/output.go:105	Connection to backoff(async(tcp://172.18.8.249:5044)) established
2026-05-26T17:07:15.364+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:07:15.365+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:07:15.934+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1500 events
2026-05-26T17:07:16.182+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2596 events
2026-05-26T17:07:17.345+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1904 events
2026-05-26T17:07:18.472+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2000 events
2026-05-26T17:07:19.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158421,"time":{"ms":171}},"total":{"ticks":1957561,"time":{"ms":2702},"value":1957561},"user":{"ticks":1799140,"time":{"ms":2531}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98850665}},"memstats":{"gc_next":23993888,"memory_alloc":19616856,"memory_total":285481762936,"rss":421888}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":8000,"active":-2196,"batches":7,"failed":5596,"total":11400},"read":{"bytes":30,"errors":1},"write":{"bytes":1227862}},"pipeline":{"clients":3,"events":{"active":2800,"published":6684,"retry":6896,"total":6683},"queue":{"acked":8000}}},"msg_file_cache":{"SecurityHits":6629},"published_events":{"Security":8000,"total":8000}}}}
2026-05-26T17:07:48.391+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:07:49.524+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1300 events
2026-05-26T17:07:49.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158500,"time":{"ms":79}},"total":{"ticks":1959187,"time":{"ms":1626},"value":1959187},"user":{"ticks":1800687,"time":{"ms":1547}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98880666}},"memstats":{"gc_next":34053280,"memory_alloc":32630112,"memory_total":285611124296,"rss":-466944}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":3200,"active":600,"batches":3,"total":3800},"read":{"bytes":42},"write":{"bytes":466521}},"pipeline":{"clients":3,"events":{"active":3000,"published":3400,"total":3400},"queue":{"acked":3200}}},"msg_file_cache":{"SecurityHits":3462},"published_events":{"Security":3200,"total":3200}}}}
2026-05-26T17:07:49.702+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 896 events
2026-05-26T17:07:49.995+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1604 events
2026-05-26T17:07:50.849+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:07:51.943+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:07:52.970+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:07:53.886+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:07:54.938+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:08:07.155+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1500 events
2026-05-26T17:08:08.420+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2596 events
2026-05-26T17:08:19.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158828,"time":{"ms":328}},"total":{"ticks":1966515,"time":{"ms":7328},"value":1966515},"user":{"ticks":1807687,"time":{"ms":7000}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98910665}},"memstats":{"gc_next":34255136,"memory_alloc":23493568,"memory_total":286233046464,"rss":81920}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":15696,"active":504,"batches":10,"total":16200},"read":{"bytes":78},"write":{"bytes":1803485}},"pipeline":{"clients":3,"events":{"active":4117,"published":16812,"total":16813},"queue":{"acked":15696}}},"msg_file_cache":{"SecurityHits":16809},"published_events":{"Security":15696,"total":15696}}}}
2026-05-26T17:08:39.462+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50622->172.18.8.249:5044: wsarecv: An established connection was aborted by the software in your host machine.
2026-05-26T17:08:39.462+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: write tcp 172.18.8.11:50622->172.18.8.249:5044: i/o timeout
2026-05-26T17:08:41.288+0800	ERROR	pipeline/output.go:121	Failed to publish events: write tcp 172.18.8.11:50622->172.18.8.249:5044: i/o timeout
2026-05-26T17:08:41.288+0800	INFO	pipeline/output.go:95	Connecting to backoff(async(tcp://172.18.8.249:5044))
2026-05-26T17:08:41.288+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:08:41.288+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:08:42.690+0800	INFO	pipeline/output.go:105	Connection to backoff(async(tcp://172.18.8.249:5044)) established
2026-05-26T17:08:42.691+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:08:42.691+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:08:49.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158828},"total":{"ticks":1966624,"time":{"ms":109},"value":1966624},"user":{"ticks":1807796,"time":{"ms":109}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98940665}},"memstats":{"gc_next":34255136,"memory_alloc":27374640,"memory_total":286236927536}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"batches":2,"failed":3004,"total":3004},"read":{"bytes":30,"errors":1},"write":{"bytes":183122,"errors":1}},"pipeline":{"clients":3,"events":{"active":4117,"retry":3004}}}}}}
2026-05-26T17:09:12.747+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50634->172.18.8.249:5044: i/o timeout
2026-05-26T17:09:12.747+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: write tcp 172.18.8.11:50634->172.18.8.249:5044: use of closed network connection
2026-05-26T17:09:12.747+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:09:12.748+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:09:14.584+0800	ERROR	pipeline/output.go:121	Failed to publish events: write tcp 172.18.8.11:50634->172.18.8.249:5044: use of closed network connection
2026-05-26T17:09:14.584+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:09:14.584+0800	INFO	pipeline/output.go:95	Connecting to backoff(async(tcp://172.18.8.249:5044))
2026-05-26T17:09:14.585+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:09:14.585+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:09:14.585+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:09:19.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":158828},"total":{"ticks":1966624,"value":1966624},"user":{"ticks":1807796}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":98970665}},"memstats":{"gc_next":34255136,"memory_alloc":27498288,"memory_total":286237051184}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":-3004,"failed":3004},"read":{"errors":1},"write":{"errors":1}},"pipeline":{"clients":3,"events":{"active":4117,"retry":1092}}}}}}
2026-05-26T17:09:37.706+0800	ERROR	pipeline/output.go:100	Failed to connect to backoff(async(tcp://172.18.8.249:5044)): dial tcp 172.18.8.249:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2026-05-26T17:09:37.706+0800	INFO	pipeline/output.go:93	Attempting to reconnect to backoff(async(tcp://172.18.8.249:5044)) with 1 reconnect attempt(s)
2026-05-26T17:09:37.706+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:09:37.707+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:09:37.707+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:09:37.707+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:09:37.708+0800	INFO	pipeline/output.go:105	Connection to backoff(async(tcp://172.18.8.249:5044)) established
2026-05-26T17:09:37.708+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:09:37.708+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:09:38.604+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 4096 events
2026-05-26T17:09:39.986+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1608 events
2026-05-26T17:09:40.986+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1600 events
2026-05-26T17:09:42.036+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1717 events
2026-05-26T17:09:43.021+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1783 events
2026-05-26T17:09:49.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":159093,"time":{"ms":265}},"total":{"ticks":1971499,"time":{"ms":4875},"value":1971499},"user":{"ticks":1812406,"time":{"ms":4610}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99000665}},"memstats":{"gc_next":34415648,"memory_alloc":23271536,"memory_total":286642589240,"rss":221184}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":10804,"active":4096,"batches":10,"total":14900},"read":{"bytes":42},"write":{"bytes":1720583}},"pipeline":{"clients":3,"events":{"active":4117,"published":10804,"retry":5596,"total":10804},"queue":{"acked":10804}}},"msg_file_cache":{"SecurityHits":10800},"published_events":{"Security":10804,"total":10804}}}}
2026-05-26T17:09:51.518+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:10:15.836+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50638->172.18.8.249:5044: use of closed network connection
2026-05-26T17:10:15.837+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: write tcp 172.18.8.11:50638->172.18.8.249:5044: i/o timeout
2026-05-26T17:10:17.162+0800	ERROR	pipeline/output.go:121	Failed to publish events: write tcp 172.18.8.11:50638->172.18.8.249:5044: i/o timeout
2026-05-26T17:10:17.162+0800	INFO	pipeline/output.go:95	Connecting to backoff(async(tcp://172.18.8.249:5044))
2026-05-26T17:10:17.162+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:10:17.162+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:10:17.163+0800	INFO	pipeline/output.go:105	Connection to backoff(async(tcp://172.18.8.249:5044)) established
2026-05-26T17:10:17.163+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:10:17.163+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:10:17.449+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1300 events
2026-05-26T17:10:17.689+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 996 events
2026-05-26T17:10:18.012+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:10:18.827+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1704 events
2026-05-26T17:10:18.827+0800	INFO	beater/eventlogger.go:73	EventLog[Application] successfully published 1 events
2026-05-26T17:10:19.686+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":159281,"time":{"ms":188}},"total":{"ticks":1974062,"time":{"ms":2563},"value":1974062},"user":{"ticks":1814781,"time":{"ms":2375}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99030665}},"memstats":{"gc_next":21289536,"memory_alloc":18935848,"memory_total":286857055840}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":7601,"active":-2296,"batches":6,"failed":2296,"total":7601},"read":{"bytes":54,"errors":1},"write":{"bytes":929480,"errors":1}},"pipeline":{"clients":3,"events":{"active":2200,"published":5685,"retry":3800,"total":5684},"queue":{"acked":7601}}},"msg_file_cache":{"ApplicationMisses":1,"ApplicationSize":1,"SecurityHits":5673},"published_events":{"Application":1,"Security":7600,"total":7601}}}}
2026-05-26T17:10:20.089+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:10:21.301+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1500 events
2026-05-26T17:10:49.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":159406,"time":{"ms":125}},"total":{"ticks":1976343,"time":{"ms":2281},"value":1976343},"user":{"ticks":1816937,"time":{"ms":2156}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99060665}},"memstats":{"gc_next":35849632,"memory_alloc":18831592,"memory_total":287050297912,"rss":32768}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":3300,"active":900,"batches":3,"total":4200},"read":{"bytes":12},"write":{"bytes":356992}},"pipeline":{"clients":3,"events":{"active":4117,"published":5216,"total":5217},"queue":{"acked":3300}}},"msg_file_cache":{"SecurityHits":5227},"published_events":{"Security":3300,"total":3300}}}}
2026-05-26T17:10:51.576+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: read tcp 172.18.8.11:50642->172.18.8.249:5044: i/o timeout
2026-05-26T17:10:51.576+0800	ERROR	logstash/async.go:256	Failed to publish events caused by: write tcp 172.18.8.11:50642->172.18.8.249:5044: use of closed network connection
2026-05-26T17:10:52.993+0800	ERROR	pipeline/output.go:121	Failed to publish events: write tcp 172.18.8.11:50642->172.18.8.249:5044: use of closed network connection
2026-05-26T17:10:52.993+0800	INFO	pipeline/output.go:95	Connecting to backoff(async(tcp://172.18.8.249:5044))
2026-05-26T17:10:52.993+0800	INFO	[publish]	pipeline/retry.go:166	retryer: send wait signal to consumer
2026-05-26T17:10:52.993+0800	INFO	[publish]	pipeline/retry.go:168	  done
2026-05-26T17:10:52.994+0800	INFO	pipeline/output.go:105	Connection to backoff(async(tcp://172.18.8.249:5044)) established
2026-05-26T17:10:52.994+0800	INFO	[publish]	pipeline/retry.go:189	retryer: send unwait-signal to consumer
2026-05-26T17:10:52.994+0800	INFO	[publish]	pipeline/retry.go:191	  done
2026-05-26T17:10:53.332+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1400 events
2026-05-26T17:10:53.603+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1300 events
2026-05-26T17:10:53.850+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1396 events
2026-05-26T17:10:54.761+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:10:55.706+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1956 events
2026-05-26T17:10:58.488+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:11:06.941+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1300 events
2026-05-26T17:11:07.125+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 996 events
2026-05-26T17:11:07.464+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:11:08.312+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1704 events
2026-05-26T17:11:09.353+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1700 events
2026-05-26T17:11:10.466+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1600 events
2026-05-26T17:11:12.219+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1700 events
2026-05-26T17:11:12.760+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:11:13.642+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1800 events
2026-05-26T17:11:14.579+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2000 events
2026-05-26T17:11:15.806+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2000 events
2026-05-26T17:11:16.595+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:11:17.768+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:11:18.586+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1804 events
2026-05-26T17:11:19.686+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160015,"time":{"ms":609}},"total":{"ticks":1990593,"time":{"ms":14250},"value":1990593},"user":{"ticks":1830578,"time":{"ms":13641}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99090667}},"memstats":{"gc_next":27971200,"memory_alloc":21527928,"memory_total":288279019424,"rss":-36864}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":34200,"active":-800,"batches":22,"failed":2700,"total":36100},"read":{"bytes":138,"errors":1},"write":{"bytes":4408910,"errors":1}},"pipeline":{"clients":3,"events":{"active":3100,"published":33184,"retry":4000,"total":33183},"queue":{"acked":34200}}},"msg_file_cache":{"SecurityHits":33100},"published_events":{"Security":34200,"total":34200}}}}
2026-05-26T17:11:20.011+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:11:21.200+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:11:22.406+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:11:23.176+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1900 events
2026-05-26T17:11:23.785+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1700 events
2026-05-26T17:11:24.765+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2000 events
2026-05-26T17:11:26.158+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2000 events
2026-05-26T17:11:27.311+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:11:27.871+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:11:29.557+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2048 events
2026-05-26T17:11:29.806+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 352 events
2026-05-26T17:11:30.445+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:11:31.466+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 33 events
2026-05-26T17:11:32.484+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 34 events
2026-05-26T17:11:33.494+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-26T17:11:34.517+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:11:35.536+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 34 events
2026-05-26T17:11:36.535+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-26T17:11:38.552+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-26T17:11:39.590+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 52 events
2026-05-26T17:11:40.618+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 47 events
2026-05-26T17:11:41.603+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-26T17:11:43.614+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:11:44.654+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-26T17:11:45.660+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:11:46.688+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-26T17:11:47.696+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-26T17:11:49.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160281,"time":{"ms":266}},"total":{"ticks":1997343,"time":{"ms":6750},"value":1997343},"user":{"ticks":1837062,"time":{"ms":6484}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99120665}},"memstats":{"gc_next":5337600,"memory_alloc":3515176,"memory_total":288939994896,"rss":196608}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":20264,"active":-1900,"batches":26,"total":18364},"read":{"bytes":162},"write":{"bytes":2323449}},"pipeline":{"clients":3,"events":{"active":42,"published":17206,"total":17206},"queue":{"acked":20264}}},"msg_file_cache":{"SecurityHits":17206},"published_events":{"Security":20264,"total":20264}}}}
2026-05-26T17:11:49.727+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-26T17:11:50.741+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-26T17:11:51.761+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 36 events
2026-05-26T17:11:52.771+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:11:53.814+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 65 events
2026-05-26T17:11:54.821+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:11:55.823+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-26T17:11:56.860+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 49 events
2026-05-26T17:11:57.855+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-26T17:11:59.883+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 38 events
2026-05-26T17:12:00.911+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 47 events
2026-05-26T17:12:01.910+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-26T17:12:02.917+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 10 events
2026-05-26T17:12:03.941+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-26T17:12:04.959+0800	INFO	beater/eventlogger.go:73	EventLog[Application] successfully published 6 events
2026-05-26T17:12:04.959+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-26T17:12:06.004+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 69 events
2026-05-26T17:12:06.004+0800	INFO	beater/eventlogger.go:73	EventLog[System] successfully published 1 events
2026-05-26T17:12:07.001+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:12:09.024+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:12:10.066+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 58 events
2026-05-26T17:12:11.061+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 7 events
2026-05-26T17:12:12.074+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-26T17:12:13.111+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 56 events
2026-05-26T17:12:14.124+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-26T17:12:15.140+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:12:16.163+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 40 events
2026-05-26T17:12:18.169+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 15 events
2026-05-26T17:12:19.190+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 31 events
2026-05-26T17:12:19.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160312,"time":{"ms":31}},"total":{"ticks":1997671,"time":{"ms":328},"value":1997671},"user":{"ticks":1837359,"time":{"ms":297}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99150665}},"memstats":{"gc_next":5710432,"memory_alloc":3254688,"memory_total":289011538600}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":868,"batches":27,"total":868},"read":{"bytes":162},"write":{"bytes":182909}},"pipeline":{"clients":3,"events":{"active":17,"published":843,"total":843},"queue":{"acked":868}}},"msg_file_cache":{"ApplicationHits":3,"ApplicationMisses":3,"ApplicationSize":2,"SecurityHits":836,"SystemMisses":1,"SystemSize":1},"published_events":{"Application":6,"Security":861,"System":1,"total":868}}}}
2026-05-26T17:12:20.200+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-26T17:12:21.219+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:12:22.249+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 49 events
2026-05-26T17:12:23.247+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 9 events
2026-05-26T17:12:25.297+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 69 events
2026-05-26T17:12:26.303+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-26T17:12:27.310+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:12:28.311+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-26T17:12:29.345+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 43 events
2026-05-26T17:12:30.348+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:12:32.380+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 44 events
2026-05-26T17:12:33.385+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-26T17:12:34.393+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-26T17:12:35.434+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 60 events
2026-05-26T17:12:36.433+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-26T17:12:37.471+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-26T17:12:38.487+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-26T17:12:39.491+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-26T17:12:40.517+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 41 events
2026-05-26T17:12:42.542+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-26T17:12:43.541+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 13 events
2026-05-26T17:12:44.567+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 33 events
2026-05-26T17:12:45.597+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 49 events
2026-05-26T17:12:46.600+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:12:48.620+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:12:49.634+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:12:49.686+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160359,"time":{"ms":47}},"total":{"ticks":1998015,"time":{"ms":344},"value":1998015},"user":{"ticks":1837656,"time":{"ms":297}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99180666}},"memstats":{"gc_next":5324128,"memory_alloc":3330824,"memory_total":289080325376,"rss":-741376}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":785,"batches":26,"total":785},"read":{"bytes":156},"write":{"bytes":168062}},"pipeline":{"clients":3,"events":{"active":37,"published":805,"total":805},"queue":{"acked":785}}},"msg_file_cache":{"SecurityHits":805},"published_events":{"Security":785,"total":785}}}}
2026-05-26T17:12:50.657+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 37 events
2026-05-26T17:12:52.656+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 9 events
2026-05-26T17:12:53.671+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:12:54.692+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 36 events
2026-05-26T17:12:55.715+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 39 events
2026-05-26T17:12:56.730+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-26T17:12:57.759+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 46 events
2026-05-26T17:12:58.757+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-26T17:12:59.776+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:13:00.809+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-26T17:13:02.823+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:13:03.839+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:13:04.844+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:13:05.886+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 53 events
2026-05-26T17:13:06.894+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:13:07.911+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-26T17:13:08.927+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:13:09.963+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 41 events
2026-05-26T17:13:10.991+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 46 events
2026-05-26T17:13:11.992+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:13:13.015+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:13:14.037+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:13:15.046+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-26T17:13:16.081+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 46 events
2026-05-26T17:13:18.082+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:13:19.095+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-26T17:13:19.685+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160390,"time":{"ms":31}},"total":{"ticks":1998436,"time":{"ms":421},"value":1998436},"user":{"ticks":1838046,"time":{"ms":390}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99210665}},"memstats":{"gc_next":8221424,"memory_alloc":5253440,"memory_total":289147389352,"rss":356352}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":761,"batches":26,"total":761},"read":{"bytes":156},"write":{"bytes":165861}},"pipeline":{"clients":3,"events":{"active":31,"published":755,"total":755},"queue":{"acked":761}}},"msg_file_cache":{"SecurityHits":755},"published_events":{"Security":761,"total":761}}}}
2026-05-26T17:13:20.113+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 31 events
2026-05-26T17:13:21.125+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:13:22.134+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:13:23.153+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:13:24.149+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2 events
2026-05-26T17:13:26.151+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1 events
2026-05-26T17:13:27.214+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 84 events
2026-05-26T17:13:28.207+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 13 events
2026-05-26T17:13:29.220+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:13:31.238+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:13:33.252+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-26T17:13:34.268+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:13:35.274+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-26T17:13:36.311+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-26T17:13:37.311+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-26T17:13:38.337+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:13:39.351+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:13:40.361+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-26T17:13:41.383+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 32 events
2026-05-26T17:13:42.431+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 54 events
2026-05-26T17:13:44.439+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 22 events
2026-05-26T17:13:45.453+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:13:46.486+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 53 events
2026-05-26T17:13:47.477+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-26T17:13:49.506+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:13:49.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160453,"time":{"ms":63}},"total":{"ticks":1998687,"time":{"ms":251},"value":1998687},"user":{"ticks":1838234,"time":{"ms":188}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99240665}},"memstats":{"gc_next":8323792,"memory_alloc":4400512,"memory_total":289209514376,"rss":24576}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":687,"batches":25,"total":687},"read":{"bytes":150},"write":{"bytes":147693}},"pipeline":{"clients":3,"events":{"active":6,"published":662,"total":662},"queue":{"acked":687}}},"msg_file_cache":{"SecurityHits":662},"published_events":{"Security":687,"total":687}}}}
2026-05-26T17:13:50.502+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 6 events
2026-05-26T17:13:51.521+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:13:52.541+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 34 events
2026-05-26T17:13:53.541+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 6 events
2026-05-26T17:13:54.585+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 52 events
2026-05-26T17:13:55.624+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 61 events
2026-05-26T17:13:56.632+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:13:57.655+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-26T17:13:58.684+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-26T17:13:59.686+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-26T17:14:01.724+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 43 events
2026-05-26T17:14:02.737+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 31 events
2026-05-26T17:14:03.750+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:14:04.780+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 46 events
2026-05-26T17:14:05.778+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 5 events
2026-05-26T17:14:05.778+0800	INFO	beater/eventlogger.go:73	EventLog[Application] successfully published 10 events
2026-05-26T17:14:07.368+0800	INFO	beater/eventlogger.go:73	EventLog[System] successfully published 4 events
2026-05-26T17:14:07.368+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 63 events
2026-05-26T17:14:08.838+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:14:09.834+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 2 events
2026-05-26T17:14:11.866+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 44 events
2026-05-26T17:14:12.883+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 34 events
2026-05-26T17:14:13.898+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:14:15.915+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-26T17:14:16.921+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 15 events
2026-05-26T17:14:17.959+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 37 events
2026-05-26T17:14:18.960+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-26T17:14:19.686+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160531,"time":{"ms":78}},"total":{"ticks":1999109,"time":{"ms":422},"value":1999109},"user":{"ticks":1838578,"time":{"ms":344}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99270666}},"memstats":{"gc_next":5779808,"memory_alloc":4831192,"memory_total":289275503728,"rss":-315392}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":771,"batches":25,"total":771},"read":{"bytes":150},"write":{"bytes":169083}},"pipeline":{"clients":3,"events":{"active":0,"published":765,"total":765},"queue":{"acked":771}}},"msg_file_cache":{"ApplicationHits":7,"ApplicationMisses":3,"SecurityHits":751,"SystemHits":3,"SystemMisses":1},"published_events":{"Application":10,"Security":757,"System":4,"total":771}}}}
2026-05-26T17:14:20.978+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 27 events
2026-05-26T17:14:21.977+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 6 events
2026-05-26T17:14:22.993+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:14:24.022+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:14:25.017+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 10 events
2026-05-26T17:14:26.025+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:14:28.079+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 60 events
2026-05-26T17:14:29.082+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:14:30.081+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-26T17:14:31.097+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:14:32.112+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-26T17:14:33.143+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-26T17:14:34.151+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:14:35.163+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 24 events
2026-05-26T17:14:36.188+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 50 events
2026-05-26T17:14:38.206+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:14:39.209+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 14 events
2026-05-26T17:14:40.245+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 52 events
2026-05-26T17:14:41.246+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 16 events
2026-05-26T17:14:42.250+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 8 events
2026-05-26T17:14:43.280+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 41 events
2026-05-26T17:14:44.301+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 41 events
2026-05-26T17:14:45.305+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:14:47.327+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:14:48.350+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 38 events
2026-05-26T17:14:49.386+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 33 events
2026-05-26T17:14:49.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160578,"time":{"ms":47}},"total":{"ticks":1999484,"time":{"ms":375},"value":1999484},"user":{"ticks":1838906,"time":{"ms":328}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99300665}},"memstats":{"gc_next":8358096,"memory_alloc":6939576,"memory_total":289340242632,"rss":544768}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":690,"batches":26,"total":690},"read":{"bytes":156},"write":{"bytes":150185}},"pipeline":{"clients":3,"events":{"active":0,"published":690,"total":690},"queue":{"acked":690}}},"msg_file_cache":{"SecurityHits":690},"published_events":{"Security":690,"total":690}}}}
2026-05-26T17:14:51.363+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 1 events
2026-05-26T17:14:52.383+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 23 events
2026-05-26T17:14:53.400+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:14:54.402+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 10 events
2026-05-26T17:14:55.423+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 29 events
2026-05-26T17:14:56.448+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 42 events
2026-05-26T17:14:57.449+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 7 events
2026-05-26T17:14:58.496+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 62 events
2026-05-26T17:14:59.492+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:15:01.512+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:15:02.530+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:15:04.539+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:15:05.558+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 30 events
2026-05-26T17:15:06.569+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:15:07.584+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 21 events
2026-05-26T17:15:08.635+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 67 events
2026-05-26T17:15:10.636+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 18 events
2026-05-26T17:15:11.636+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 3 events
2026-05-26T17:15:12.671+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 45 events
2026-05-26T17:15:13.673+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 17 events
2026-05-26T17:15:14.708+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 49 events
2026-05-26T17:15:16.726+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 35 events
2026-05-26T17:15:17.733+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 19 events
2026-05-26T17:15:18.774+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 55 events
2026-05-26T17:15:19.684+0800	INFO	[monitoring]	log/log.go:144	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":160593,"time":{"ms":15}},"total":{"ticks":1999733,"time":{"ms":249},"value":1999733},"user":{"ticks":1839140,"time":{"ms":234}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":99330665}},"memstats":{"gc_next":8481520,"memory_alloc":4266992,"memory_total":289401305352,"rss":45056}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":671,"batches":24,"total":671},"read":{"bytes":144},"write":{"bytes":144285}},"pipeline":{"clients":3,"events":{"active":0,"published":671,"total":671},"queue":{"acked":671}}},"msg_file_cache":{"SecurityHits":671},"published_events":{"Security":671,"total":671}}}}
2026-05-26T17:15:20.771+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:15:21.814+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 55 events
2026-05-26T17:15:22.812+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 12 events
2026-05-26T17:15:23.829+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 26 events
2026-05-26T17:15:24.851+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 36 events
2026-05-26T17:15:26.856+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 11 events
2026-05-26T17:15:27.876+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 25 events
2026-05-26T17:15:28.889+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 20 events
2026-05-26T17:15:29.922+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 48 events
2026-05-26T17:15:30.934+0800	INFO	beater/eventlogger.go:73	EventLog[Security] successfully published 28 events
2026-05-26T17:15:31.950+0800	INFO	beater/eventlogge