X(60 O` <2026-05-15.loghE'#X0=  &<.winlogbeat.yml.newhE'#00  &<.winlogbeat.yml.newhE'#(1jց  &<.winlogbeat.yml.new`G#1  <.winlogbeat.ymlhE'#1  &<.winlogbeat.yml.new`E'#X2  <.winlogbeat.yml`E'#2  <.winlogbeat.ymlX(636  <2026-05-15.logX(6p36  <2026-05-15.logX(63\  <2026-05-15.logX(6 4\  <2026-05-15.logX(6x4J  <2026-05-15.logX(64J  <2026-05-15.logX(6(5k  <2026-05-15.logX(65k  <2026-05-15.logX(65k  <2026-05-15.logX(606k  <2026-05-15.logX(66  <2026-05-15.logX(66  <2026-05-15.logX(687  <2026-05-15.logX(67  <2026-05-15.logX(67Y  <2026-05-15.logX(6@8Y  <2026-05-15.loghG#89}  &<.winlogbeat.yml.newhG#9J_}  &<.winlogbeat.yml.newhG#h9}  &<.winlogbeat.yml.new`E'#9}  <.winlogbeat.ymlhG#0:}  &<.winlogbeat.yml.new`G#:}  <.winlogbeat.yml`G#:}  <.winlogbeat.ymlX(6X;  <2026-05-15.logX(6;  <2026-05-15.logX(6<  <2026-05-15.logX(6`<  <2026-05-15.logX(6<  <2026-05-15.logX(6=  <2026-05-15.logX(6h=3  <2026-05-15.logX(6=3  <2026-05-15.logX(6>#Z  <2026-05-15.logX(6p>#Z  <2026-05-15.logX(6>#Z  <2026-05-15.logX(6 ?#Z  <2026-05-15.logX(6x?(  <2026-05-15.logX(6@(  <2026-05-15.logX(6X@(  <2026-05-15.logX(6@  <2026-05-15.logX(6Ads <2026-05-15.logX(6`Ads <2026-05-15.logX(6As <2026-05-15.logX(6Bs <2026-05-15.logX(6hBs <2026-05-15.logX(6Bs <2026-05-15.logX(6C{s <2026-05-15.logX(6pC{s <2026-05-15.logX(6Cs <2026-05-15.logX(6 Ds <2026-05-15.logX(6xDs <2026-05-15.logX(6Ds <2026-05-15.logX(6(E#t <2026-05-15.logX(6E#t <2026-05-15.logX(6E#t <2026-05-15.logX(60F#t <2026-05-15.loghE(#Fy &<.winlogbeat.yml.newhE(#FZy &<.winlogbeat.yml.newhE(#XGy &<.winlogbeat.yml.new`G#Gpy <.winlogbeat.ymlhE(# Hpy &<.winlogbeat.yml.new`E(#Hpy <.winlogbeat.yml`E(#Hpy <.winlogbeat.ymlhG#HI u &<.winlogbeat.yml.newhG#I40u &<.winlogbeat.yml.newhG#J|u &<.winlogbeat.yml.new`E(#Ju <.winlogbeat.ymlhG#Ju &<.winlogbeat.yml.new`G#HKu <.winlogbeat.yml`G#Ku <.winlogbeat.ymlX(6Lm$ <2026-05-15.logX(6`Lm$ <2026-05-15.logX(6L3$ <2026-05-15.logX(6M3$ <2026-05-15.logX(6hMK$ <2026-05-15.logX(6MK$ <2026-05-15.logX(6Nz$ <2026-05-15.logX(6pNz$ <2026-05-15.logX(6Nz$ <2026-05-15.logX(6 O% <2026-05-15.logX(6xO% <2026-05-15.logX(6P% <2026-05-15.logX(6XP,% <2026-05-15.logX(6P,% <2026-05-15.logX(6Q,% <2026-05-15.logX(6`Q,% <2026-05-15.logX(6QO <2026-05-15.logX(6RO <2026-05-15.logX(6hRt <2026-05-15.logX(6Rt <2026-05-15.logX(6Sݚ <2026-05-15.logX(6pSݚ <2026-05-15.logX(6S <2026-05-15.logX(6 T <2026-05-15.logX(6xT <2026-05-15.logX(6T <2026-05-15.logX(6(U <2026-05-15.logX(6U <2026-05-15.logX(6U <2026-05-15.logX(60V <2026-05-15.logX(6V  <2026-05-15.logX(6V  <2026-05-15.loghE)#8W(p &<.winlogbeat.yml.newhE)#W>p &<.winlogbeat.yml.newhE)#Xrq &<.winlogbeat.yml.new`G#pX+q <.winlogbeat.ymlhE)#X+q &<.winlogbeat.yml.new`E)#8Y+q <.winlogbeat.yml`E)#Y+q <.winlogbeat.ymlX(6Y <2026-05-15.logX(6PZ! <2026-05-15.logX(6ZG <2026-05-15.logX(6[G <2026-05-15.logX(6X[G <2026-05-15.logX(6[G <2026-05-15.logX(6\>m <2026-05-15.logX(6`\>m <2026-05-15.logX(6\ <2026-05-15.logX(6] <2026-05-15.logX(6h] <2026-05-15.logX(6] <2026-05-15.logX(6^ <2026-05-15.logX(6p^ <2026-05-15.logX(6^wߖ <2026-05-15.logX(6 _wߖ <2026-05-15.loghG#x_gl &<.winlogbeat.yml.new6.972+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 26 events 2026-05-27T02:51:49.008+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T02:51:49.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":203890,"time":{"ms":31}},"total":{"ticks":2438108,"time":{"ms":343},"value":2438108},"user":{"ticks":2234218,"time":{"ms":312}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":133920665}},"memstats":{"gc_next":8483600,"memory_alloc":4866960,"memory_total":368617637880,"rss":-528384}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":873,"batches":27,"total":873},"read":{"bytes":162},"write":{"bytes":187282}},"pipeline":{"clients":3,"events":{"active":17,"published":866,"total":866},"queue":{"acked":873}}},"msg_file_cache":{"ApplicationHits":7,"ApplicationMisses":3,"SecurityHits":852,"SystemHits":4},"published_events":{"Application":10,"Security":859,"System":4,"total":873}}}} 2026-05-27T02:51:50.010+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T02:51:51.045+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 52 events 2026-05-27T02:51:52.048+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T02:51:54.069+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T02:51:55.100+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-05-27T02:51:56.131+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T02:51:57.130+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-27T02:51:58.156+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 36 events 2026-05-27T02:52:00.161+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-27T02:52:01.175+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:52:03.206+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 39 events 2026-05-27T02:52:04.225+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 37 events 2026-05-27T02:52:05.228+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-27T02:52:06.238+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 14 events 2026-05-27T02:52:07.273+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 52 events 2026-05-27T02:52:09.289+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:52:10.296+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 17 events 2026-05-27T02:52:11.332+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 51 events 2026-05-27T02:52:12.345+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:52:13.355+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T02:52:14.381+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 43 events 2026-05-27T02:52:15.389+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:52:17.405+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T02:52:18.424+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T02:52:19.435+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T02:52:19.684+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":203921,"time":{"ms":31}},"total":{"ticks":2438421,"time":{"ms":313},"value":2438421},"user":{"ticks":2234500,"time":{"ms":282}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":133950665}},"memstats":{"gc_next":5232208,"memory_alloc":4477736,"memory_total":368683780136,"rss":475136}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":732,"batches":25,"total":732},"read":{"bytes":150},"write":{"bytes":155047}},"pipeline":{"clients":3,"events":{"active":58,"published":773,"total":773},"queue":{"acked":732}}},"msg_file_cache":{"ApplicationSize":-1,"SecurityHits":773},"published_events":{"Security":732,"total":732}}}} 2026-05-27T02:52:20.478+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 58 events 2026-05-27T02:52:21.473+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 9 events 2026-05-27T02:52:22.477+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 6 events 2026-05-27T02:52:23.515+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T02:52:25.513+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-05-27T02:52:26.528+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T02:52:27.552+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 35 events 2026-05-27T02:52:28.561+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T02:52:29.578+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T02:52:30.600+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 34 events 2026-05-27T02:52:31.599+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 7 events 2026-05-27T02:52:32.635+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 48 events 2026-05-27T02:52:33.638+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T02:52:34.648+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T02:52:36.676+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 38 events 2026-05-27T02:52:37.669+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 2 events 2026-05-27T02:52:38.684+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T02:52:39.718+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 47 events 2026-05-27T02:52:40.731+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 32 events 2026-05-27T02:52:41.760+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 42 events 2026-05-27T02:52:42.768+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T02:52:44.810+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 54 events 2026-05-27T02:52:45.816+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T02:52:47.832+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T02:52:48.855+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 40 events 2026-05-27T02:52:49.686+0800 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":203968,"time":{"ms":47}},"total":{"ticks":2438718,"time":{"ms":297},"value":2438718},"user":{"ticks":2234750,"time":{"ms":250}}},"handles":{"open":319},"info":{"ephemeral_id":"b55e52da-9ae7-4162-b39d-62ee521b137d","uptime":{"ms":133980666}},"memstats":{"gc_next":5791744,"memory_alloc":3127824,"memory_total":368746312240,"rss":24576}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":716,"batches":25,"total":716},"read":{"bytes":150},"write":{"bytes":155868}},"pipeline":{"clients":3,"events":{"active":13,"published":671,"total":671},"queue":{"acked":716}}},"msg_file_cache":{"SecurityHits":671},"published_events":{"Security":716,"total":716}}}} 2026-05-27T02:52:49.858+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 13 events 2026-05-27T02:52:50.863+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-05-27T02:52:51.879+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T02:52:52.892+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 19 events 2026-05-27T02:52:54.907+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 27 events 2026-05-27T02:52:55.925+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 30 events 2026-05-27T02:52:56.934+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 20 events 2026-05-27T02:52:57.961+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T02:52:58.975+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 25 events 2026-05-27T02:52:59.980+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 15 events 2026-05-27T02:53:00.997+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 24 events 2026-05-27T02:53:02.012+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 22 events 2026-05-27T02:53:04.015+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 10 events 2026-05-27T02:53:05.057+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 55 events 2026-05-27T02:53:07.060+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 11 events 2026-05-27T02:53:08.073+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 21 events 2026-05-27T02:53:10.092+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T02:53:11.106+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 23 events 2026-05-27T02:53:12.121+0800 INFO beater/eventlogger.go:73 EventLog[Security] successfully published 28 events 2026-05-27T02:53:13.142+0800 INFO beater/eventlogger.go:73 Eve