2019-12-17T14:34:21.303+0100	INFO	instance/beat.go:610	Home path: [C:\Users\ps-admin\Desktop\winlogbeat-oss-7.5.0-windows-x86_64\winlogbeat-7.5.0-windows-x86_64] Config path: [C:\Users\ps-admin\Desktop\winlogbeat-oss-7.5.0-windows-x86_64\winlogbeat-7.5.0-windows-x86_64] Data path: [C:\Users\ps-admin\Desktop\winlogbeat-oss-7.5.0-windows-x86_64\winlogbeat-7.5.0-windows-x86_64\data] Logs path: [C:\Users\ps-admin\Desktop\winlogbeat-oss-7.5.0-windows-x86_64\winlogbeat-7.5.0-windows-x86_64\logs]
2019-12-17T14:34:21.344+0100	INFO	instance/beat.go:618	Beat ID: 23f4b4dc-091d-4af6-9f84-faf4230d363e
2019-12-17T14:34:21.356+0100	INFO	[beat]	instance/beat.go:941	Beat info	{"system_info": {"beat": {"path": {"config": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64", "data": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64\\data", "home": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64", "logs": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64\\logs"}, "type": "winlogbeat", "uuid": "23f4b4dc-091d-4af6-9f84-faf4230d363e"}}}
2019-12-17T14:34:21.357+0100	INFO	[beat]	instance/beat.go:950	Build info	{"system_info": {"build": {"commit": "6d0d0ae079e5cb1d4f224801ac6df926dfb1594c", "libbeat": "7.5.0", "time": "2019-11-25T23:57:00.000Z", "version": "7.5.0"}}}
2019-12-17T14:34:21.357+0100	INFO	[beat]	instance/beat.go:953	Go runtime info	{"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":2,"version":"go1.12.12"}}}
2019-12-17T14:34:21.360+0100	INFO	add_cloud_metadata/add_cloud_metadata.go:89	add_cloud_metadata: hosting provider type not detected.
2019-12-17T14:34:21.366+0100	INFO	[beat]	instance/beat.go:957	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-08-28T14:11:20.49+02:00","name":"AD01","ip":["fe80::4856:6793:c986:9d0b/64","10.10.103.242/24","46.163.103.242/28","::1/128","127.0.0.1/8","fe80::200:5efe:2ea3:67f2/128","fe80::5efe:a0a:67f2/128"],"kernel_version":"10.0.14393.3179 (rs1_release_1.190806-2245)","mac":["00:50:56:3f:16:21","00:50:56:3f:16:20","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2016 Standard","version":"10.0","major":10,"minor":0,"patch":0,"build":"14393.3181"},"timezone":"CET","timezone_offset_sec":3600,"id":"2e082758-d1ff-4c13-b58d-c3c37af56cff"}}}
2019-12-17T14:34:21.368+0100	INFO	[beat]	instance/beat.go:986	Process info	{"system_info": {"process": {"cwd": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64", "exe": "C:\\Users\\ps-admin\\Desktop\\winlogbeat-oss-7.5.0-windows-x86_64\\winlogbeat-7.5.0-windows-x86_64\\winlogbeat.exe", "name": "winlogbeat.exe", "pid": 1892, "ppid": 3408, "start_time": "2019-12-17T14:34:21.009+0100"}}}
2019-12-17T14:34:21.369+0100	INFO	instance/beat.go:297	Setup Beat: winlogbeat; Version: 7.5.0
2019-12-17T14:34:21.369+0100	INFO	[index-management]	idxmgmt/std.go:182	Set output.elasticsearch.index to 'winlogbeat-7.5.0' as ILM is enabled.
2019-12-17T14:34:21.369+0100	INFO	elasticsearch/client.go:171	Elasticsearch url: http://10.10.103.252:9200
2019-12-17T14:34:21.369+0100	INFO	[publisher]	pipeline/module.go:97	Beat name: AD01
2019-12-17T14:34:21.369+0100	INFO	beater/winlogbeat.go:69	State will be read from and persisted to C:\Users\ps-admin\Desktop\winlogbeat-oss-7.5.0-windows-x86_64\winlogbeat-7.5.0-windows-x86_64\data\.winlogbeat.yml
2019-12-17T14:34:21.370+0100	INFO	instance/beat.go:429	winlogbeat start running.
2019-12-17T14:34:21.370+0100	INFO	[monitoring]	log/log.go:118	Starting metrics logging every 30s
2019-12-17T14:34:22.399+0100	INFO	pipeline/output.go:95	Connecting to backoff(elasticsearch(http://10.10.103.252:9200))
2019-12-17T14:34:22.411+0100	INFO	elasticsearch/client.go:753	Attempting to connect to Elasticsearch version 7.5.0
2019-12-17T14:34:22.417+0100	INFO	template/load.go:89	Template winlogbeat-7.5.0 already exists and will not be overwritten.
2019-12-17T14:34:22.417+0100	INFO	[index-management]	idxmgmt/std.go:293	Loaded index template.
2019-12-17T14:34:22.418+0100	INFO	pipeline/output.go:105	Connection to backoff(elasticsearch(http://10.10.103.252:9200)) established
2019-12-17T14:34:22.420+0100	INFO	beater/eventlogger.go:81	EventLog[Security] successfully published 3 events
2019-12-17T14:34:43.468+0100	INFO	beater/eventlogger.go:81	EventLog[Security] successfully published 11 events
2019-12-17T14:34:51.376+0100	INFO	[monitoring]	log/log.go:145	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":203,"time":{"ms":203}},"total":{"ticks":281,"time":{"ms":281},"value":281},"user":{"ticks":78,"time":{"ms":78}}},"handles":{"open":224},"info":{"ephemeral_id":"9727d5bc-856c-42aa-a2c9-78587dd8baa7","uptime":{"ms":30119}},"memstats":{"gc_next":5487472,"memory_alloc":3492440,"memory_total":7558344,"rss":29511680},"runtime":{"goroutines":28}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":14,"batches":2,"total":14},"read":{"bytes":2172},"type":"elasticsearch","write":{"bytes":40475}},"pipeline":{"clients":3,"events":{"active":0,"published":14,"retry":3,"total":14},"queue":{"acked":14}}},"msg_file_cache":{"SecurityHits":16,"SecurityMisses":1,"SecuritySize":1},"published_events":{"Security":14,"total":14},"system":{"cpu":{"cores":2}}}}}
2019-12-17T14:34:54.484+0100	INFO	beater/eventlogger.go:81	EventLog[Security] successfully published 1 events
2019-12-17T14:35:21.375+0100	INFO	[monitoring]	log/log.go:145	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":234,"time":{"ms":31}},"total":{"ticks":343,"time":{"ms":62},"value":343},"user":{"ticks":109,"time":{"ms":31}}},"handles":{"open":230},"info":{"ephemeral_id":"9727d5bc-856c-42aa-a2c9-78587dd8baa7","uptime":{"ms":60117}},"memstats":{"gc_next":5487472,"memory_alloc":4088112,"memory_total":8154016,"rss":106496},"runtime":{"goroutines":28}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":1,"batches":1,"total":1},"read":{"bytes":336},"write":{"bytes":1882}},"pipeline":{"clients":3,"events":{"active":3,"published":4,"total":4},"queue":{"acked":1}}},"msg_file_cache":{"SecurityHits":4},"published_events":{"Security":1,"total":1}}}}
2019-12-17T14:35:21.558+0100	INFO	beater/eventlogger.go:81	EventLog[Security] successfully published 3 events
2019-12-17T14:35:30.603+0100	INFO	beater/eventlogger.go:81	EventLog[Security] successfully published 6 events
2019-12-17T14:35:51.384+0100	INFO	[monitoring]	log/log.go:145	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":312,"time":{"ms":78}},"total":{"ticks":421,"time":{"ms":78},"value":421},"user":{"ticks":109}},"handles":{"open":233},"info":{"ephemeral_id":"9727d5bc-856c-42aa-a2c9-78587dd8baa7","uptime":{"ms":90127}},"memstats":{"gc_next":6028288,"memory_alloc":3128352,"memory_total":9112936,"rss":843776},"runtime":{"goroutines":28}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":9,"batches":2,"total":9},"read":{"bytes":741},"write":{"bytes":25033}},"pipeline":{"clients":3,"events":{"active":0,"published":6,"total":6},"queue":{"acked":9}}},"msg_file_cache":{"SecurityHits":6},"published_events":{"Security":9,"total":9}}}}
2019-12-17T14:36:07.153+0100	INFO	beater/winlogbeat.go:169	Stopping Winlogbeat
2019-12-17T14:36:07.661+0100	INFO	beater/eventlogger.go:118	EventLog[System] Stop processing.
2019-12-17T14:36:07.661+0100	INFO	beater/eventlogger.go:118	EventLog[Application] Stop processing.
2019-12-17T14:36:07.661+0100	INFO	beater/eventlogger.go:118	EventLog[Security] Stop processing.
2019-12-17T14:36:07.662+0100	INFO	[monitoring]	log/log.go:153	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":312,"time":{"ms":312}},"total":{"ticks":421,"time":{"ms":421},"value":421},"user":{"ticks":109,"time":{"ms":109}}},"handles":{"open":221},"info":{"ephemeral_id":"9727d5bc-856c-42aa-a2c9-78587dd8baa7","uptime":{"ms":106404}},"memstats":{"gc_next":6028288,"memory_alloc":3239024,"memory_total":9223608,"rss":30527488},"runtime":{"goroutines":16}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":24,"batches":5,"total":24},"read":{"bytes":3249},"type":"elasticsearch","write":{"bytes":67390}},"pipeline":{"clients":0,"events":{"active":0,"published":24,"retry":3,"total":24},"queue":{"acked":24}}},"msg_file_cache":{"SecurityHits":26,"SecurityMisses":1,"SecuritySize":1},"published_events":{"Security":24,"total":24},"system":{"cpu":{"cores":2}}}}}
2019-12-17T14:36:07.662+0100	INFO	[monitoring]	log/log.go:154	Uptime: 1m46.405278s
2019-12-17T14:36:07.662+0100	INFO	[monitoring]	log/log.go:131	Stopping metrics logging.
2019-12-17T14:36:07.662+0100	INFO	instance/beat.go:435	winlogbeat stopped.