{
  "_index": "template1-squid-access-1",
  "_type": "doc",
  "_id": "r_JYrWcBSWXW68GXKSJd",
  "_version": 1,
  "_score": null,
  "fields": {
    "BYTES_SENT": [
      2504
    ],
    "@timestamp": [
      "2018-12-14T14:11:11.000Z"
    ],
    "PORT": [
      "443"
    ],
    "BYTES_RECEIVED": [
      3904
    ],
    "DESTINATION": [
      "settings-win.data.microsoft.com"
    ],
    "SOURCE_IP": [
      "192.168.118.108"
    ],
    "PROTOCOL": [
      "https"
    ],
    "METHOD": [
      "CONNECT"
    ],
    "USER": [
      "Administrator@SIBUR.RU"
    ],
    "HTTP_RESPONSE": [
      "200"
    ],
    "tags": [
      "access",
      "beats_input_codec_plain_applied",
      "_grokparsefailure"
    ],
    "beat.hostname.keyword": [
      "logstash002"
    ]
  },
  "sort": [
    1544796671000
  ]
}