go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:57:54.120+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T02:57:56.143+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T02:57:57.154+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T02:57:58.160+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-05-27T02:57:59.189+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 41 events 2026-05-27T02:58:01.186+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T02:58:02.200+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:58:03.253+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 56 events 2026-05-27T02:58:04.244+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T02:58:05.271+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T02:58:06.309+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 59 events 2026-05-27T02:58:07.313+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T02:58:08.332+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T02:58:09.348+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T02:58:10.355+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:58:11.389+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-05-27T02:58:12.397+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T02:58:14.411+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T02:58:15.436+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T02:58:16.448+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 29 events 2026-05-27T02:58:17.457+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T02:58:18.471+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T02:58:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":204375},"total":{"ticks":2442218,"time":{"ms":297},"value":2442218},"user":{"ticks":2237843,"time":{"ms":297}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":134310665}},"memstats":{"gc_next":5254720,"memory_alloc":2924584,"memory_total":369445992512,"rss":573440}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":702,"batches":26,"total":702},"read":{"bytes":156},"write":{"bytes":152999}},"pipeline":{"clients":3,"events":{"active":16,"published":687,"total":687},"queue":{"acked":702}}},"msg_file_cache":{"SecurityHits":687},"published_events":{"Security":702,"total":702}}}} 2026-05-27T02:58:20.484+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 16 events 2026-05-27T02:58:22.526+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 57 events 2026-05-27T02:58:23.540+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T02:58:24.562+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T02:58:25.581+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T02:58:26.593+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T02:58:27.635+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 60 events 2026-05-27T02:58:29.628+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 8 events 2026-05-27T02:58:30.643+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T02:58:31.663+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:58:32.681+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:58:33.694+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T02:58:34.712+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:58:35.717+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T02:58:36.769+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 62 events 2026-05-27T02:58:37.773+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T02:58:38.774+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-05-27T02:58:40.801+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-05-27T02:58:41.801+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T02:58:42.812+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-27T02:58:43.861+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 74 events 2026-05-27T02:58:45.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T02:58:46.879+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 31 events 2026-05-27T02:58:47.917+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 46 events 2026-05-27T02:58:48.939+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T02:58:49.686+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":204390,"time":{"ms":15}},"total":{"ticks":2442515,"time":{"ms":297},"value":2442515},"user":{"ticks":2238125,"time":{"ms":282}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":134340666}},"memstats":{"gc_next":8421904,"memory_alloc":4407504,"memory_total":369511333840}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":764,"batches":25,"total":764},"read":{"bytes":150},"write":{"bytes":161044}},"pipeline":{"clients":3,"events":{"active":5,"published":753,"total":753},"queue":{"acked":764}}},"msg_file_cache":{"SecurityHits":753},"published_events":{"Security":764,"total":764}}}} 2026-05-27T02:58:49.934+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 5 events 2026-05-27T02:58:50.968+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 45 events 2026-05-27T02:58:51.988+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T02:58:53.017+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 49 events 2026-05-27T02:58:54.054+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-05-27T02:58:55.049+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T02:58:56.069+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T02:58:57.096+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-05-27T02:58:58.101+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T02:59:00.119+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T02:59:01.130+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T02:59:02.128+0800 INFO beater/eventlogger.go:73 EventLog[SecuXh60') <2026-07-30.logXh6X0') <2026-07-30.logXh60'P' <2026-07-30.logXh61'P' <2026-07-30.logXh6`1'v' <2026-07-30.logXh61'v' <2026-07-30.logXh62'v' <2026-07-30.logXh6h2'v' <2026-07-30.logXh62'Χ <2026-07-30.logXh63'75Χ <2026-07-30.logXh6p3'75Χ <2026-07-30.logXh63'75Χ <2026-07-30.logXh6 4'?[Χ <2026-07-30.logXh6x4'?[Χ <2026-07-30.loghuK#4'X &<.winlogbeat.yml.newhuK#85'X &<.winlogbeat.yml.newhuK#5'#;'DST &<.winlogbeat.yml.newhu>#<'IyT &<.winlogbeat.yml.newhu>#<'T &<.winlogbeat.yml.new`uK#<' T <.winlogbeat.ymlhu>#H=' T &<.winlogbeat.yml.new`u>#=' T <.winlogbeat.yml`u>#>' T <.winlogbeat.ymlXh6p>'ƫ <2026-07-30.logXh6>'ƫ <2026-07-30.logXh6 ?'ƫ <2026-07-30.logXh6x?'ƫ <2026-07-30.logXh6@'+ƫ <2026-07-30.logXh6X@'+ƫ <2026-07-30.logXh6@'  <2026-07-30.logXh6A'  <2026-07-30.logXh6`A'  <2026-07-30.logXh6A'  <2026-07-30.logXh6B'  <2026-07-30.logXh6hB'  <2026-07-30.logXh6B'  <2026-07-30.logXh6C'  <2026-07-30.logXh6pC')  <2026-07-30.logXh6C')  <2026-07-30.logXh6 D')  <2026-07-30.logXh6xD'=O  <2026-07-30.logXh6D'=O  <2026-07-30.logXh6(E'=O  <2026-07-30.logXh6E'u  <2026-07-30.logXh6E'u  <2026-07-30.logXh60F'u  <2026-07-30.logXh6F'  <2026-07-30.logXh6F'(; <2026-07-30.logXh68G'(; <2026-07-30.logXh6G'; <2026-07-30.logXh6G'; <2026-07-30.logXh6@H'{ < <2026-07-30.logXh6H'{ < <2026-07-30.logXh6H' <2026-07-30.logXh6HI' <2026-07-30.logXh6I'ӽ <2026-07-30.logXh6I'ӽ <2026-07-30.logXh6PJ'ӽ <2026-07-30.logXh6J'ӽ <2026-07-30.loghuL#K'(P &<.winlogbeat.yml.newhuL#hK'tP &<.winlogbeat.yml.newhuL#K'@P &<.winlogbeat.yml.new`u>#8L'P <.winlogbeat.ymlhuL#L'P &<.winlogbeat.yml.new`uL#M'P <.winlogbeat.yml`uL#`M'P <.winlogbeat.ymlXh6M'5 <2026-07-30.logXh6N'5 <2026-07-30.logXh6pN'5 <2026-07-30.logXh6N'5 <2026-07-30.logXh6 O'* <2026-07-30.logXh6xO'* <2026-07-30.loghu?#P'K &<.winlogbeat.yml.newhu?#hP'nK &<.winlogbeat.yml.newhu?#P'IL &<.winlogbeat.yml.new`uL#8Q'oL <.winlogbeat.ymlhu?#Q'oL &<.winlogbeat.yml.new`u?#R'oL <.winlogbeat.yml`u?#`R'oL <.winlogbeat.ymlXh6R'EZ <2026-07-30.logXh6S'4 <2026-07-30.logXh