No data appears in the Discover tab.
The filebeat 0365 agent log shows hundreds of entries like the following:
| 2021-09-07T09:34:45.757-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454828,time:{ms:47}},total:{ticks:1506640,time:{ms:47},value:1506640},user:{ticks:1051812}},handles:{open:341},info:{ephemeral_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592350191},version:7.14.0},memstats:{gc_next:116944976,memory_alloc:58793600,memory_total:54508858752,rss:105738240},runtime:{goroutines:32}},filebeat:{harvester:{open_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} |
|---|---|---|---|---|---|
| 2021-09-07T09:35:15.759-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454843,time:{ms:47}},total:{ticks:1506655,time:{ms:47},value:1506655},user:{ticks:1051812}},handles:{open:343},info:{ephemeral_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592380188},version:7.14.0},memstats:{gc_next:116944976,memory_alloc:58952160,memory_total:54509017312,rss:105738240},runtime:{goroutines:32}},filebeat:{harvester:{open_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} |
| 2021-09-07T09:35:45.752-0500 | INFO | [monitoring] | log/log.go:145 | Non-zero metrics in the last 30s | {monitoring: {metrics: {beat:{cpu:{system:{ticks:454984,time:{ms:109}},total:{ticks:1506968,time:{ms:281},value:1506968},user:{ticks:1051984,time:{ms:172}}},handles:{open:344},info:{ephemeral_id:4e14a072-e267-438e-b7a1-09c48c2ecff5,uptime:{ms:592410215},version:7.14.0},memstats:{gc_next:116943616,memory_alloc:58471616,memory_total:54512770440,rss:105766912},runtime:{goroutines:34}},filebeat:{harvester:{open_files:0,running:0}},libbeat:{config:{module:{running:1}},output:{events:{active:2531},read:{bytes:210}},pipeline:{clients:5,events:{active:4120}}},registrar:{states:{current:0}}}}} |
In the Exchange Powershell, the audit log is enabled:
