Kafdrop: Topic: logstash-local-network: Messages

Offset: 1537746 Key: Timestamp: 2025-12-09 15:23:31.380 Headers: empty

{"@version":"1","event":{"hash":"e6f62402a066b6bce7bca1259361cc7977d5f08b39f0246f6c53975eb19327e5"},"ecs":{"version":"1.6.0"},"message":"1765293808.675974\tC9xOqo1ME0nW9EJkI1\t172.30.1.12\t60840\t8.8.8.8\t53\tudp\t12375\t0.027601\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t146.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:30.858Z","host":{"name":"f6b540842a86"},"log":{"offset":374845,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537747 Key: Timestamp: 2025-12-09 15:23:31.380 Headers: empty

{"@version":"1","event":{"hash":"d7d074e097f5bab7e967e3489c381081a7f571510204dc22a5064440d96b9641"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293799.326875\tCnxsP01kEDdaKOoJaj\t172.30.1.12\t44508\t8.8.8.8\t53\tudp\tdns\t0.028030\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:30.272Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":412169},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537748 Key: Timestamp: 2025-12-09 15:23:32.962 Headers: empty

{"@version":"1","event":{"hash":"e0c23d9307774395f7c1eb5959fa94f3b2a9d97aef6881eda5ece572e486b6be"},"ecs":{"version":"1.6.0"},"message":"1765293809.708011\tCLmjdt2QFWpNqag8Wj\t172.30.1.12\t55206\t8.8.8.8\t53\tudp\t12376\t0.024599\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t145.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:31.858Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":375020},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537749 Key: Timestamp: 2025-12-09 15:23:33.963 Headers: empty

{"@version":"1","event":{"hash":"62c8844efafc5c14fbb2cce29580d1ec484b38d3eef610f950c7a9281cb0beb6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293800.365772\tCEGsD11XOR47UuNOUa\t172.30.1.12\t52155\t8.8.8.8\t53\tudp\tdns\t0.027601\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":412427,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537750 Key: Timestamp: 2025-12-09 15:23:33.963 Headers: empty

{"@version":"1","event":{"hash":"1be11e680123908ef17e42ee69d653a05f02fa9847e7218c52c047b720e0d120"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293802.148444\tCJxvCb4UbVDPgwxm9l\t172.30.1.35\t59643\t172.30.1.254\t53\tudp\tdns\t0.469543\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":412909,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537751 Key: Timestamp: 2025-12-09 15:23:33.963 Headers: empty

{"@version":"1","event":{"hash":"465e9025e2e53eeadcddcec079f698e03c5b28b5705f6211f241e6ccdde452bd"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293802.191128\tCQklmn30GdW7HHpRne\t172.30.1.35\t59643\t8.8.8.8\t53\tudp\tdns\t0.027443\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":412783,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537752 Key: Timestamp: 2025-12-09 15:23:33.964 Headers: empty

{"@version":"1","event":{"hash":"49ee8bf20b67bfaa4fe9f9f0ba9aeb531fe2969703ed52583c0d29ee8d7e5bde"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293801.395819\tCI9pnS3y8W5s3Q6Hkj\t172.30.1.12\t48630\t8.8.8.8\t53\tudp\tdns\t0.029847\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":412551,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537753 Key: Timestamp: 2025-12-09 15:23:33.964 Headers: empty

{"@version":"1","event":{"hash":"c332577d22ea2b18b905ba2aeedf0ea7f498f303fa278f31f46a8065c18356e0"},"ecs":{"version":"1.6.0"},"message":"1765293810.735883\tCl3wXz3srZDINK6Aif\t172.30.1.12\t36727\t8.8.8.8\t53\tudp\t12377\t0.027987\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t144.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:32.859Z","host":{"name":"f6b540842a86"},"log":{"offset":375195,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537754 Key: Timestamp: 2025-12-09 15:23:33.964 Headers: empty

{"@version":"1","event":{"hash":"512581cdb1e55e823a628d234278118392ed92d92c13c81d8ac593299e5e2017"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293802.408069\tCgnjfg1NFXKujYWcp8\t172.30.1.63\t60683\t8.8.8.8\t53\tudp\tdns\t0.027941\t58\t250\tSF\tT\tF\t0\tDd\t1\t86\t1\t278\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":413040,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537755 Key: Timestamp: 2025-12-09 15:23:33.964 Headers: empty

{"@version":"1","event":{"hash":"413dfc4dfbe3a2c899c70e72048ebe0862132a31fa56ff8c8751e4d35535996f"},"ecs":{"version":"1.6.0"},"message":"1765293811.765932\tCJucZK3EojO8l02g7d\t172.30.1.12\t47113\t8.8.8.8\t53\tudp\t12378\t0.029344\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t143.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:32.859Z","host":{"name":"f6b540842a86"},"log":{"offset":375370,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537756 Key: Timestamp: 2025-12-09 15:23:33.964 Headers: empty

{"@version":"1","event":{"hash":"82c10149889a9bc8dcecb1d28ba5a938a68395d830293acdba31281737c4ff92"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293802.464715\tCLStuU3gAGanpSldza\t172.30.1.12\t49402\t8.8.8.8\t53\tudp\tdns\t0.027315\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":413166,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537757 Key: Timestamp: 2025-12-09 15:23:33.963 Headers: empty

{"@version":"1","event":{"hash":"3b39a0a28f46314e12897738926c282356aa089b3e541266964378acd75a3e3a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293751.488852\tCFraX1mtwRuIkZ0Sj\t172.30.1.132\t3\t8.8.8.8\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tF\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.272Z","host":{"name":"f6b540842a86"},"log":{"offset":412675,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537758 Key: Timestamp: 2025-12-09 15:23:34.964 Headers: empty

{"@version":"1","event":{"hash":"3daca636c5fef5fab8dd188e541df6bd3a17836f82ff5253302ccd12500e4fc6"},"ecs":{"version":"1.6.0"},"message":"1765293812.191261\tCgHCsp32Xg9fE5nMck\t172.30.1.35\t58685\t8.8.8.8\t53\tudp\t36292\t0.030384\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3354.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:33.859Z","host":{"name":"f6b540842a86"},"log":{"offset":375545,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537759 Key: Timestamp: 2025-12-09 15:23:34.964 Headers: empty

{"@version":"1","event":{"hash":"3054596cbb8ef2c480d76a25171ae2358485f639e5ed673232a3af734007fb87"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293803.496165\tCBlSP211x3WUbIVlx\t172.30.1.12\t49483\t8.8.8.8\t53\tudp\tdns\t0.027500\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:34.273Z","host":{"name":"f6b540842a86"},"log":{"offset":413414,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537760 Key: Timestamp: 2025-12-09 15:23:34.964 Headers: empty

{"@version":"1","event":{"hash":"0ce5f282075c186f9cc4f17aeb60534f3e289af12208bf778a840251efe60005"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293802.435898\tCRbU2x2TGUlj2pctRd\t172.30.1.12\t46178\t8.8.8.8\t53\tudp\tdns\t0.027210\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:34.273Z","host":{"name":"f6b540842a86"},"log":{"offset":413290,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537761 Key: Timestamp: 2025-12-09 15:23:35.964 Headers: empty

{"@version":"1","event":{"hash":"d1b8fc18e0522f8c64cb2ef5a89abf0b6f5ad58517291dce63240f9cc049bc35"},"ecs":{"version":"1.6.0"},"message":"1765293812.167108\tC5uupyf5WtL0aBdR8\t172.30.1.35\t58685\t172.30.1.254\t53\tudp\t36292\t0.306230\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2748.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:34.860Z","host":{"name":"f6b540842a86"},"log":{"offset":375714,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537762 Key: Timestamp: 2025-12-09 15:23:35.964 Headers: empty

{"@version":"1","event":{"hash":"cbfdd2ac4c81dc8374b0212887be3259f50afb5f4605973c6031e1dfcaf6952b"},"ecs":{"version":"1.6.0"},"message":"1765293812.805897\tCQbWDs2v4Hsgw4wZya\t172.30.1.12\t50071\t8.8.8.8\t53\tudp\t12379\t0.029907\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t181.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:34.860Z","host":{"name":"f6b540842a86"},"log":{"offset":375887,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537763 Key: Timestamp: 2025-12-09 15:23:36.964 Headers: empty

{"@version":"1","event":{"hash":"3f3ec1e7b3936b96569e9c544ae0649ba0fd8c95593d4f43add4cdfedb8d7d7e"},"ecs":{"version":"1.6.0"},"message":"1765293813.845917\tCPHFWLkR67OHhg1u2\t172.30.1.12\t53518\t8.8.8.8\t53\tudp\t12380\t0.027190\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t248.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:35.860Z","host":{"name":"f6b540842a86"},"log":{"offset":376062,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537764 Key: Timestamp: 2025-12-09 15:23:37.968 Headers: empty

{"@version":"1","event":{"hash":"c49a98c7b494618161c43135356c9c44cac7e32b45aea99e6bbd80ef94c951a2"},"ecs":{"version":"1.6.0"},"message":"1765293814.910980\tChaU3z31OaFHbNBcd3\t172.30.1.12\t51575\t8.8.8.8\t53\tudp\t12381\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t140.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:36.861Z","host":{"name":"f6b540842a86"},"log":{"offset":376236,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537765 Key: Timestamp: 2025-12-09 15:23:37.969 Headers: empty

{"@version":"1","event":{"hash":"d97f9705e70179f18401cccc95e3b79c7a8bd8620c1fe4f01ccd8ccc2c292849"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293688.273669\tCOhOfU3NOsJhTAvG98\t172.30.1.35\t62820\t142.250.204.206\t443\tudp\t-\t66.280201\t13720\t27024\tSF\tT\tF\t0\tDd\t38\t14784\t45\t28284\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:37.273Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":413537},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537766 Key: Timestamp: 2025-12-09 15:23:37.969 Headers: empty

{"@version":"1","event":{"hash":"508f039acdb71af0ce490ec6579fa99f4ac2f90b9e8237b65790982c8f08d8dd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293805.565830\tCqsfh34hlbgmLCGqif\t172.30.1.12\t35381\t8.8.8.8\t53\tudp\tdns\t0.028710\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:37.273Z","host":{"name":"f6b540842a86"},"log":{"offset":413923,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537767 Key: Timestamp: 2025-12-09 15:23:37.969 Headers: empty

{"@version":"1","event":{"hash":"8b6a76fa555ff29b1deeef26fe998ffbe7b51c0cf69e99e1845e7ca25b9517c7"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293809.754487\tC7s12HtNxFPu16Elk\t172.30.1.63\t44262\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:37.273Z","host":{"name":"f6b540842a86"},"log":{"offset":413683,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537768 Key: Timestamp: 2025-12-09 15:23:37.969 Headers: empty

{"@version":"1","event":{"hash":"3d781711e126e6bccf4ce2ad9efc986735bff9f88e3899e81021523273ace378"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293804.525853\tCz9Aoe6Ibb1pZ0qc4\t172.30.1.12\t38934\t8.8.8.8\t53\tudp\tdns\t0.028750\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:37.273Z","host":{"name":"f6b540842a86"},"log":{"offset":413800,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537769 Key: Timestamp: 2025-12-09 15:23:37.969 Headers: empty

{"@version":"1","event":{"hash":"6ea544a421871b2a227e407c918ad52e38fa41f83be985b1849485e1ac493379"},"ecs":{"version":"1.6.0"},"message":"1765293815.905996\tCBH8bT3PnfjXSZdLW2\t172.30.1.12\t49652\t8.8.8.8\t53\tudp\t12382\t0.027001\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t139.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:37.861Z","host":{"name":"f6b540842a86"},"log":{"offset":376404,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537770 Key: Timestamp: 2025-12-09 15:23:39.378 Headers: empty

{"@version":"1","event":{"hash":"269a1b3312555049d7508b2e04b683c8b5773d51ed6e90bb894114e10f148318"},"ecs":{"version":"1.6.0"},"message":"1765293816.935964\tC8yqlL2Mo3QFtOuQs4\t172.30.1.12\t51988\t8.8.8.8\t53\tudp\t12383\t0.028940\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t245.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:38.861Z","host":{"name":"f6b540842a86"},"log":{"offset":376579,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537771 Key: Timestamp: 2025-12-09 15:23:39.378 Headers: empty

{"@version":"1","event":{"hash":"79418c5339547756083c4e36eb5ba9d2ea8472ec74fac601a9109982bd3a0dfb"},"ecs":{"version":"1.6.0"},"message":"1765293817.201715\tCXzxzU20rQqrc2mD5e\t172.30.1.35\t51994\t8.8.8.8\t53\tudp\t26342\t0.030263\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3349.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:38.861Z","host":{"name":"f6b540842a86"},"log":{"offset":376754,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537772 Key: Timestamp: 2025-12-09 15:23:39.378 Headers: empty

{"@version":"1","event":{"hash":"dfecab095d305f00ff572ef4253e801e2d95b16394029a7c559b5333b7acc2f4"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293807.147688\tCByffwt6Yx3HcrxYc\t172.30.1.35\t56573\t172.30.1.254\t53\tudp\tdns\t0.005462\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:38.274Z","host":{"name":"f6b540842a86"},"log":{"offset":414171,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537773 Key: Timestamp: 2025-12-09 15:23:39.378 Headers: empty

{"@version":"1","event":{"hash":"2871bcb13c7097efa64159e68a3b8f283830d937d0b791e970810ef6b50a1227"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293806.605985\tCnkQAl4ISJQEjYgDO4\t172.30.1.12\t51573\t8.8.8.8\t53\tudp\tdns\t0.027956\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:38.274Z","host":{"name":"f6b540842a86"},"log":{"offset":414047,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537774 Key: Timestamp: 2025-12-09 15:23:40.379 Headers: empty

{"@version":"1","event":{"hash":"7858a1cb249a9243355ca54e701e3cbeba31c98531be2eb98f84f940436cab7a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293807.645866\tCRfyhg1t0FR0gtQlE8\t172.30.1.12\t37792\t8.8.8.8\t53\tudp\tdns\t0.027621\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:39.275Z","host":{"name":"f6b540842a86"},"log":{"offset":414301,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537775 Key: Timestamp: 2025-12-09 15:23:40.379 Headers: empty

{"@version":"1","event":{"hash":"e6c8c146bb581bed1bbeff0df21b4d12a007056b574450b8b8652b43b2cc8279"},"ecs":{"version":"1.6.0"},"message":"1765293817.159352\tCNEsbc2rRwKtWyg5o2\t172.30.1.35\t51994\t172.30.1.254\t53\tudp\t26342\t0.270994\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2743.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:39.862Z","host":{"name":"f6b540842a86"},"log":{"offset":376923,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537776 Key: Timestamp: 2025-12-09 15:23:40.379 Headers: empty

{"@version":"1","event":{"hash":"2c9800d411d25cdd8d0e5635e081808b95bb83183fa513757dae32e0933a0d5b"},"ecs":{"version":"1.6.0"},"message":"1765293818.084452\tCRawsq2cIHppDHYM3\t172.30.1.132\t49975\t8.8.8.8\t53\tudp\t31155\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:39.862Z","host":{"name":"f6b540842a86"},"log":{"offset":377097,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537777 Key: Timestamp: 2025-12-09 15:23:40.379 Headers: empty

{"@version":"1","event":{"hash":"f9999d99770382079bf2f05debbde960f5cd91618f530515a7777bc79a265929"},"ecs":{"version":"1.6.0"},"message":"1765293818.084489\tC28tuT2eqtJX6OokNk\t172.30.1.132\t49975\t172.30.1.254\t53\tudp\t31155\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:39.862Z","host":{"name":"f6b540842a86"},"log":{"offset":377248,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537778 Key: Timestamp: 2025-12-09 15:23:40.379 Headers: empty

{"@version":"1","event":{"hash":"5a8ed7427ab3a41c1ae84fcb5cac45aee3de2febb3da6e3aced527a2a24f0d7f"},"ecs":{"version":"1.6.0"},"message":"1765293818.058776\tCufpMH3zBMZaN0hUkd\t172.30.1.12\t52165\t8.8.8.8\t53\tudp\t12384\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t137.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:39.862Z","host":{"name":"f6b540842a86"},"log":{"offset":377405,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537779 Key: Timestamp: 2025-12-09 15:23:41.380 Headers: empty

{"@version":"1","event":{"hash":"103b91f7bb7b93e3fd1cb544e6d91459580f2b946be55083b781615cef657952"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293808.675974\tC9xOqo1ME0nW9EJkI1\t172.30.1.12\t60840\t8.8.8.8\t53\tudp\tdns\t0.027601\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:40.275Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":414425},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537780 Key: Timestamp: 2025-12-09 15:23:41.380 Headers: empty

{"@version":"1","event":{"hash":"f5b945a2bf2a4ecba2ff95afc1f9259c790ab69769adc0d4540ff319adc1ceaf"},"ecs":{"version":"1.6.0"},"message":"1765293819.015953\tCRLfdcyNd4FpP41c\t172.30.1.12\t35082\t8.8.8.8\t53\tudp\t12385\t0.028438\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t174.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:40.862Z","host":{"name":"f6b540842a86"},"log":{"offset":377573,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537781 Key: Timestamp: 2025-12-09 15:23:42.380 Headers: empty

{"@version":"1","event":{"hash":"e9b891d981e464d4943e04f4e35b34a47c1416d522480dd45110f9cef31ea064"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293809.708011\tCLmjdt2QFWpNqag8Wj\t172.30.1.12\t55206\t8.8.8.8\t53\tudp\tdns\t0.024599\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:41.276Z","host":{"name":"f6b540842a86"},"log":{"offset":414549,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537782 Key: Timestamp: 2025-12-09 15:23:42.380 Headers: empty

{"@version":"1","event":{"hash":"9f8345be29ce8a715a5e724cfd0f88382203fef53b8cd911e178983e2b9e997a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293814.712493\tCpRDXx2MmxbEjklvok\t172.30.1.2\t42702\t172.30.4.139\t1514\ttcp\t-\t2.998800\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:41.276Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":414673},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537783 Key: Timestamp: 2025-12-09 15:23:42.380 Headers: empty

{"@version":"1","event":{"hash":"044c48d292c8db4bc6feabee9edd9d3b0fa4c8ceaf2dbf0c8ea66c14bd60fae7"},"ecs":{"version":"1.6.0"},"message":"1765293820.055990\tC34xRSin9v0vkqQZ6\t172.30.1.12\t54368\t8.8.8.8\t53\tudp\t12386\t0.029578\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t241.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:41.863Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":377746},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537784 Key: Timestamp: 2025-12-09 15:23:43.387 Headers: empty

{"@version":"1","event":{"hash":"82bb68d023374e1a9a707f74bb4890023a8be1161a71545bb9049637594e3bc6"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293810.735883\tCl3wXz3srZDINK6Aif\t172.30.1.12\t36727\t8.8.8.8\t53\tudp\tdns\t0.027987\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:42.276Z","host":{"name":"f6b540842a86"},"log":{"offset":414798,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537785 Key: Timestamp: 2025-12-09 15:23:43.387 Headers: empty

{"@version":"1","event":{"hash":"730d996b3784c9d2c56a1447d8ac80fed6aa523a881b4a5ef6bf0c9b6c589200"},"ecs":{"version":"1.6.0"},"message":"1765293821.096180\tCLoa5I3FyFiZ8XPqZ9\t172.30.1.12\t34364\t8.8.8.8\t53\tudp\t12387\t0.026970\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t133.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:42.863Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":377920},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537786 Key: Timestamp: 2025-12-09 15:23:44.389 Headers: empty

{"@version":"1","event":{"hash":"0e45b3568f8775811022bef57f60bbe3b28110491699635917a6bc11b966a11d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293811.765932\tCJucZK3EojO8l02g7d\t172.30.1.12\t47113\t8.8.8.8\t53\tudp\tdns\t0.029344\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:43.284Z","host":{"name":"f6b540842a86"},"log":{"offset":414922,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537787 Key: Timestamp: 2025-12-09 15:23:44.389 Headers: empty

{"@version":"1","event":{"hash":"2f85ead44e69e9b1ab4a29a57f7ea75757daf91e8983bbe7c002a4d6077d4942"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293812.191261\tCgHCsp32Xg9fE5nMck\t172.30.1.35\t58685\t8.8.8.8\t53\tudp\tdns\t0.030384\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:43.284Z","host":{"name":"f6b540842a86"},"log":{"offset":415046,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537788 Key: Timestamp: 2025-12-09 15:23:44.389 Headers: empty

{"@version":"1","event":{"hash":"cc3529b8389cb8bc7d9638b72efe6ac04854e6d9771ec1b46c5b27a7790395ac"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293812.151484\tC5uupyf5WtL0aBdR8\t172.30.1.35\t58685\t172.30.1.254\t53\tudp\tdns\t0.280775\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:43.284Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":415172},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537789 Key: Timestamp: 2025-12-09 15:23:44.389 Headers: empty

{"@version":"1","event":{"hash":"c88bff5cd2ea28e6f3611f2f7545613833425c024e219838ebcaedee1dc9e425"},"ecs":{"version":"1.6.0"},"message":"1765293822.168032\tCo57Gi4LJjgKuppHi\t172.30.1.12\t36921\t8.8.8.8\t53\tudp\t12388\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t132.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:43.864Z","host":{"name":"f6b540842a86"},"log":{"offset":378095,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537790 Key: Timestamp: 2025-12-09 15:23:44.389 Headers: empty

{"@version":"1","event":{"hash":"05a3fbdcbb67914d524c89e259415175b8a8f92fdda2d2355141e56daa8704aa"},"ecs":{"version":"1.6.0"},"message":"1765293822.148611\tCjLjKY3W2Z5lOOE2Cl\t172.30.1.35\t59248\t172.30.1.254\t53\tudp\t8909\t0.005331\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2738.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:43.864Z","host":{"name":"f6b540842a86"},"log":{"offset":378262,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537791 Key: Timestamp: 2025-12-09 15:23:45.388 Headers: empty

{"@version":"1","event":{"hash":"107dd3cc62d151472714077abeefab54a4786baa59e6086252957f31b8eff4a8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293812.805897\tCQbWDs2v4Hsgw4wZya\t172.30.1.12\t50071\t8.8.8.8\t53\tudp\tdns\t0.029907\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:44.284Z","host":{"name":"f6b540842a86"},"log":{"offset":415302,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537792 Key: Timestamp: 2025-12-09 15:23:45.388 Headers: empty

{"@version":"1","event":{"hash":"28bcaffd6ff6585fb6ec08e81ccaa1fe97d27ec4cd4548f9cb09c06eab8c261b"},"ecs":{"version":"1.6.0"},"message":"1765293823.168494\tCT9XQ02ygnh0ARpvDf\t172.30.1.12\t37583\t8.8.8.8\t53\tudp\t12389\t0.026261\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t131.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:44.864Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":378435},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537793 Key: Timestamp: 2025-12-09 15:23:46.389 Headers: empty

{"@version":"1","event":{"hash":"688ffe2e1e324a7267ea116dedce470a1e3f4c8f4921ef188125d899978a60ab"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765290192.609943\tCxeqG41NEcVPDuS5h3\t45.164.220.214\t56263\t172.30.1.2\t443\ttcp\t-\t31.539418\t0\t0\tOTH\tF\tT\t0\t^hS\t1\t52\t6\t312\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:45.284Z","host":{"name":"f6b540842a86"},"log":{"offset":415426,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537794 Key: Timestamp: 2025-12-09 15:23:46.389 Headers: empty

{"@version":"1","event":{"hash":"82777dbb17599f01e766aad2ed59142add943e357cf7d49302c95723a6c99c43"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293813.845917\tCPHFWLkR67OHhg1u2\t172.30.1.12\t53518\t8.8.8.8\t53\tudp\tdns\t0.027190\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:45.285Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":415557},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537795 Key: Timestamp: 2025-12-09 15:23:46.389 Headers: empty

{"@version":"1","event":{"hash":"8fa6097d6214d72c5bf0cf59353254a9cd70e29daf63767c633d39326b63f081"},"ecs":{"version":"1.6.0"},"message":"1765293824.206614\tCPbfTq23e5b3BpgsSg\t172.30.1.12\t54816\t8.8.8.8\t53\tudp\t12390\t0.029460\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t130.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:45.864Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":378610},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537796 Key: Timestamp: 2025-12-09 15:23:47.391 Headers: empty

{"@version":"1","event":{"hash":"b32710f2a9a0705319f835301365dc1f6d6db94117eaae7644c7c921e8854d3c"},"ecs":{"version":"1.6.0"},"message":"1765293825.246033\tCJcqml2vAon8Rm8Nce\t172.30.1.12\t34078\t8.8.8.8\t53\tudp\t12391\t0.060926\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t129.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:46.865Z","host":{"name":"f6b540842a86"},"log":{"offset":378785,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537797 Key: Timestamp: 2025-12-09 15:23:47.391 Headers: empty

{"@version":"1","event":{"hash":"b922a9abef3ccc3330dd0f98da5b3f9feb7ef09ee8ecf23c8d1aac6d4426ab82"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293814.875899\tChaU3z31OaFHbNBcd3\t172.30.1.12\t51575\t8.8.8.8\t53\tudp\tdns\t0.027622\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:46.285Z","host":{"name":"f6b540842a86"},"log":{"offset":415680,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537798 Key: Timestamp: 2025-12-09 15:23:48.390 Headers: empty

{"@version":"1","event":{"hash":"cdf11328918559c9a593a12d87e2e97daa8a6f332493689a105348399db6e73e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293815.905996\tCBH8bT3PnfjXSZdLW2\t172.30.1.12\t49652\t8.8.8.8\t53\tudp\tdns\t0.027001\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:47.286Z","host":{"name":"f6b540842a86"},"log":{"offset":415804,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537799 Key: Timestamp: 2025-12-09 15:23:48.391 Headers: empty

{"@version":"1","event":{"hash":"b60b85d96c19222d233b65f95d5d9715a83e0187350b4550e136ebfaa0917dae"},"ecs":{"version":"1.6.0"},"message":"1765293826.286027\tChVKccZ7lJtldJ27j\t172.30.1.12\t42603\t8.8.8.8\t53\tudp\t12392\t0.028323\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t128.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:47.865Z","host":{"name":"f6b540842a86"},"log":{"offset":378960,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537800 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"6521cc087a3ec735618309184cc045e28e74286d8021f698238dfbcfbab9d8e6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293816.935964\tC8yqlL2Mo3QFtOuQs4\t172.30.1.12\t51988\t8.8.8.8\t53\tudp\tdns\t0.028940\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.287Z","host":{"name":"f6b540842a86"},"log":{"offset":416059,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537801 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"fba778b13f2bcded403cb902b6feba2475300a7ae0539f68f21985d4a8955c92"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293817.201715\tCXzxzU20rQqrc2mD5e\t172.30.1.35\t51994\t8.8.8.8\t53\tudp\tdns\t0.030263\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.287Z","host":{"name":"f6b540842a86"},"log":{"offset":416183,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537802 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"3a9b7adc9b04579810f132b65d9afeaf7d41fff88ec70e40328a46666c29cef2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765290196.305643\tC8PdVT1zmfQB86ycX\t45.164.222.61\t21647\t172.30.1.2\t443\ttcp\t-\t31.043835\t0\t0\tS1\tF\tT\t0\tSh\t1\t52\t6\t312\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.287Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":416309},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537803 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"da3bcdf95c3245603facb21e1aa3cae050147319a0a84cdc87d94e18d79aeb29"},"ecs":{"version":"1.6.0"},"message":"1765293827.243629\tCXDOSk3zUFmFMpj9Fj\t172.30.1.35\t61305\t172.30.1.254\t53\tudp\t21900\t0.259727\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2733.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.866Z","host":{"name":"f6b540842a86"},"log":{"offset":379470,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537804 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"17adcadb3403adefdd7664473bef934e1e9968bce3e4fd8e42a00c4c2bf924ce"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293817.159352\tCNEsbc2rRwKtWyg5o2\t172.30.1.35\t51994\t172.30.1.254\t53\tudp\tdns\t0.270994\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.287Z","host":{"name":"f6b540842a86"},"log":{"offset":415928,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537805 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"6cbc7456126b38101cdc6eb361bb15753aa4943b452b4f5d39a4aee4ded82894"},"ecs":{"version":"1.6.0"},"message":"1765293827.232720\tCCwN3j2oqA4cc7Zzgg\t172.30.1.35\t61305\t8.8.8.8\t53\tudp\t21900\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2529.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.866Z","host":{"name":"f6b540842a86"},"log":{"offset":379134,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537806 Key: Timestamp: 2025-12-09 15:23:49.391 Headers: empty

{"@version":"1","event":{"hash":"05c825ade3a2c44bba63587f6a9cd4d4241bbe2ed4e8f8fcdb376161e5ebf17d"},"ecs":{"version":"1.6.0"},"message":"1765293827.326378\tClrkjJ3EFSdxZjT1i\t172.30.1.12\t59642\t8.8.8.8\t53\tudp\t12393\t0.029463\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t166.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:48.866Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":379296},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537807 Key: Timestamp: 2025-12-09 15:23:50.394 Headers: empty

{"@version":"1","event":{"hash":"1ebc9169b213490b2ce83fd5774f2d16bec1683bbf029fc03e03a4fe5611558f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293818.084489\tC28tuT2eqtJX6OokNk\t172.30.1.132\t49975\t172.30.1.254\t53\tudp\tdns\t0.005407\t43\t43\tSF\tT\tT\t0\tDd\t1\t71\t1\t71\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:49.287Z","host":{"name":"f6b540842a86"},"log":{"offset":416436,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537808 Key: Timestamp: 2025-12-09 15:23:50.394 Headers: empty

{"@version":"1","event":{"hash":"348a8c364f6d43fbf414c1987a62a9728d9eab437dfe62e3ed1980147732c9d8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293817.976312\tCufpMH3zBMZaN0hUkd\t172.30.1.12\t52165\t8.8.8.8\t53\tudp\tdns\t0.028531\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:49.287Z","host":{"name":"f6b540842a86"},"log":{"offset":416690,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537809 Key: Timestamp: 2025-12-09 15:23:50.394 Headers: empty

{"@version":"1","event":{"hash":"832e1f924f517279bed20002a5ee492dda0c3edfc1b7ecc9e658ed0ca57f2d88"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293818.084452\tCRawsq2cIHppDHYM3\t172.30.1.132\t49975\t8.8.8.8\t53\tudp\tdns\t0.029817\t43\t43\tSF\tT\tF\t0\tDd\t1\t71\t1\t71\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:49.287Z","host":{"name":"f6b540842a86"},"log":{"offset":416566,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537810 Key: Timestamp: 2025-12-09 15:23:50.394 Headers: empty

{"@version":"1","event":{"hash":"b73ca1bb92f67234749d34eccf5c959a46e0fedfc3d22fea3806f67f645381ac"},"ecs":{"version":"1.6.0"},"message":"1765293828.366087\tCwqsd21pYYXhPodN9h\t172.30.1.12\t50332\t8.8.8.8\t53\tudp\t12394\t0.029668\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t126.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:49.866Z","host":{"name":"f6b540842a86"},"log":{"offset":379644,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537811 Key: Timestamp: 2025-12-09 15:23:51.392 Headers: empty

{"@version":"1","event":{"hash":"e6a99cac0e22edb96f89c9e6cd420dc9d57af49f913d7133584a35fa63601e3a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293819.015953\tCRLfdcyNd4FpP41c\t172.30.1.12\t35082\t8.8.8.8\t53\tudp\tdns\t0.028438\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:50.288Z","host":{"name":"f6b540842a86"},"log":{"offset":416814,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537812 Key: Timestamp: 2025-12-09 15:23:51.392 Headers: empty

{"@version":"1","event":{"hash":"c5b70faf7b4a261f521e9217830b52c30cd261ae3f533f02f580727add1821cf"},"ecs":{"version":"1.6.0"},"message":"1765293829.406079\tCMvRso4xzi86w0Ff15\t172.30.1.12\t55678\t8.8.8.8\t53\tudp\t12395\t0.040966\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t125.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:50.867Z","host":{"name":"f6b540842a86"},"log":{"offset":379819,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537813 Key: Timestamp: 2025-12-09 15:23:52.392 Headers: empty

{"@version":"1","event":{"hash":"e0e0b1c4bd7507161afe488edf21a0da7c8ed6b7c4344af67774045f83d1c06a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293820.055990\tC34xRSin9v0vkqQZ6\t172.30.1.12\t54368\t8.8.8.8\t53\tudp\tdns\t0.029578\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:51.288Z","host":{"name":"f6b540842a86"},"log":{"offset":416936,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537814 Key: Timestamp: 2025-12-09 15:23:52.392 Headers: empty

{"@version":"1","event":{"hash":"55a3cbe9cfaf4c9f8fbbf6767c13f24c70cbcb0312aab5b8c454546ca811057c"},"ecs":{"version":"1.6.0"},"message":"1765293830.446804\tCX4dAYks6ZbT87TS4\t172.30.1.12\t47068\t8.8.8.8\t53\tudp\t12396\t0.027247\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t124.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:51.867Z","host":{"name":"f6b540842a86"},"log":{"offset":379994,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537815 Key: Timestamp: 2025-12-09 15:23:53.404 Headers: empty

{"@version":"1","event":{"hash":"62714187e1cbf0081b663c1cb8eb59468d1a1b7cee743fa9ed137addbfd08469"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293771.512525\tC8rvxp22L3lTM1wDbb\t172.30.1.132\t37769\t216.239.35.12\t123\tudp\tntp\t0.029119\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:52.288Z","host":{"name":"f6b540842a86"},"log":{"offset":417183,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537816 Key: Timestamp: 2025-12-09 15:23:53.404 Headers: empty

{"@version":"1","event":{"hash":"344ce1117339d75c433d175010fbbb55d2d0ac69e476f6c9eaba6e6460601b8a"},"ecs":{"version":"1.6.0"},"message":"1765293831.516164\tC9s4hf4UHliaZYhUB5\t172.30.1.12\t51620\t8.8.8.8\t53\tudp\t12398\t0.028511\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t230.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:52.868Z","host":{"name":"f6b540842a86"},"log":{"offset":380343,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537817 Key: Timestamp: 2025-12-09 15:23:53.404 Headers: empty

{"@version":"1","event":{"hash":"17939be4efcf1e04130147eceba3165e71d3695b6363d57adb6dbe9a954baafd"},"ecs":{"version":"1.6.0"},"message":"1765293830.475721\tCgGUQH21QxRrdPFoDi\t172.30.1.12\t50006\t8.8.8.8\t53\tudp\t12397\t0.028836\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t163.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:52.868Z","host":{"name":"f6b540842a86"},"log":{"offset":380168,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537818 Key: Timestamp: 2025-12-09 15:23:53.404 Headers: empty

{"@version":"1","event":{"hash":"a2f46762c09a7602a697a45ac23f52ffbef57b2d12aa1e2471c9fcb87cddc25b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293821.096180\tCLoa5I3FyFiZ8XPqZ9\t172.30.1.12\t34364\t8.8.8.8\t53\tudp\tdns\t0.026970\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:52.288Z","host":{"name":"f6b540842a86"},"log":{"offset":417059,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537819 Key: Timestamp: 2025-12-09 15:23:54.394 Headers: empty

{"@version":"1","event":{"hash":"77e79364ff4d66ebd59bb0d212cb1006cc43065544ee99446a13125fea670423"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293822.148611\tCjLjKY3W2Z5lOOE2Cl\t172.30.1.35\t59248\t172.30.1.254\t53\tudp\tdns\t0.005331\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:53.289Z","host":{"name":"f6b540842a86"},"log":{"offset":417438,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537820 Key: Timestamp: 2025-12-09 15:23:54.394 Headers: empty

{"@version":"1","event":{"hash":"c09ba0907e85287825d86775493987a7a9edbdf10f99e0d340bf8222bd2250e2"},"ecs":{"version":"1.6.0"},"message":"1765293832.171401\tCp4hTU31gdZT0VWate\t172.30.1.35\t54214\t172.30.1.254\t53\tudp\t49501\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2728.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:53.869Z","host":{"name":"f6b540842a86"},"log":{"offset":380518,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537821 Key: Timestamp: 2025-12-09 15:23:54.394 Headers: empty

{"@version":"1","event":{"hash":"50c98d940eec38516e260b8f44dc3492bad273762305dc4fb51a40361f4a21c0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293827.712361\tCIcrrv2lVahXXzUb64\t172.30.1.2\t42704\t172.30.4.139\t1514\ttcp\t-\t2.998974\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:53.289Z","host":{"name":"f6b540842a86"},"log":{"offset":417569,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537822 Key: Timestamp: 2025-12-09 15:23:54.394 Headers: empty

{"@version":"1","event":{"hash":"fd1d58445970cc5f048c29328f149cf531ea31d2d72468e4cb1cd7b89473445e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765293822.126164\tCo57Gi4LJjgKuppHi\t172.30.1.12\t36921\t8.8.8.8\t53\tudp\tdns\t0.029451\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:53.289Z","host":{"name":"f6b540842a86"},"log":{"offset":417315,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537823 Key: Timestamp: 2025-12-09 15:23:54.394 Headers: empty

{"@version":"1","event":{"hash":"3592f9cb6dc3fe0aac26c78aafe736fd25d2852cf37b0d6f909bccd99bd8bac3"},"ecs":{"version":"1.6.0"},"message":"1765293832.561274\tCqX6DH1QXAfxgyahPh\t172.30.1.12\t44803\t8.8.8.8\t53\tudp\t12399\t0.023872\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t122.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:53.869Z","host":{"name":"f6b540842a86"},"log":{"offset":380685,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537824 Key: Timestamp: 2025-12-09 15:23:55.394 Headers: empty

{"@version":"1","event":{"hash":"a793dae6eba7472d78707dd8e681552c4e60d1ee8690076afda47e6cb2c7d81e"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293823.168494\tCT9XQ02ygnh0ARpvDf\t172.30.1.12\t37583\t8.8.8.8\t53\tudp\tdns\t0.026261\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:54.290Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":417694},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537825 Key: Timestamp: 2025-12-09 15:23:55.394 Headers: empty

{"@version":"1","event":{"hash":"8dad0b7542451f2555b8b01f75c6534ac8bef699a1cb40dc9768a43e4d08afc1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293823.748677\tCSxZJb3CfwXLsZJPT3\t172.30.1.15\t5353\t224.0.0.251\t5353\tudp\tdns\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t903\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:54.290Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":417818},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537826 Key: Timestamp: 2025-12-09 15:23:55.394 Headers: empty

{"@version":"1","event":{"hash":"d4ef0282835c5f588a483663a50894c665901762ea697755e5104ce168f3973a"},"ecs":{"version":"1.6.0"},"message":"1765293833.598439\tCDZT4k1v8ORjJP0Lg7\t172.30.1.12\t42157\t8.8.8.8\t53\tudp\t12400\t0.076439\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t228.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:54.869Z","host":{"name":"f6b540842a86"},"log":{"offset":380860,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537827 Key: Timestamp: 2025-12-09 15:23:55.394 Headers: empty

{"@version":"1","event":{"hash":"c3cf6edf563f61364138aa8627c91492bf9a003a1ebea96a05f336545a474cfc"},"ecs":{"version":"1.6.0"},"message":"1765293823.772757\tCSxZJb3CfwXLsZJPT3\t172.30.1.15\t5353\t224.0.0.251\t5353\tudp\t0\t-\tdocucentre-iv c2263  (e2:77:a9)._printer._tcp.local\t-\t-\t-\t-\t0\tNOERROR\tT\tF\tF\tF\t0\tTXT 9 txtvers=1 TXT 7 rp=auto TXT 8 qtotal=1 TXT 11 priority=20 TXT 23 ty=DocuCentre-IV C2263  TXT 30 product=(DocuCentre-IV C2263 ) TXT 90 pdl=application/postscript\\x2capplication/pdf\\x2capplication/vnd.hp-PCLXL\\x2capplication/vnd.hp-PCL TXT 31 adminurl=http://FXe277a9.local. TXT 18 usb_MFG=FUJI XEROX TXT 28 usb_MDL=DocuCentre-IV C2263  TXT 13 Transparent=T TXT 8 Binary=T TXT 6 TBCP=F,_printer._tcp.local,docucentre-iv c2263  (e2:77:a9)._printer._tcp.local,TXT 9 txtvers=1 TXT 8 qtotal=1 TXT 11 priority=10 TXT 23 ty=DocuCentre-IV C2263  TXT 30 product=(DocuCentre-IV C2263 ) TXT 90 pdl=application/postscript\\x2capplication/pdf\\x2capplication/vnd.hp-PCLXL\\x2capplication/vnd.hp-PCL TXT 31 adminurl=http://FXe277a9.local. TXT 18 usb_MFG=FUJI XEROX TXT 28 usb_MDL=DocuCentre-IV C2263  TXT 13 Transparent=T TXT 8 Binary=T TXT 6 TBCP=F,_pdl-datastream._tcp.local,docucentre-iv c2263  (e2:77:a9)._pdl-datastream._tcp.local,TXT 0 ,_http._tcp.local,docucentre-iv c2263  (e2:77:a9)._http._tcp.local\t4500.000000,4500.000000,4500.000000,4500.000000,4500.000000,4500.000000,4500.000000,4500.000000,4500.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:54.869Z","host":{"name":"f6b540842a86"},"log":{"offset":381035,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537828 Key: Timestamp: 2025-12-09 15:23:55.394 Headers: empty

{"@version":"1","event":{"hash":"fc14ad3ce97f3bb8017538a1c3e19065a79d4ce00f40235e53d8c58bdc5da963"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765293824.206614\tCPbfTq23e5b3BpgsSg\t172.30.1.12\t54816\t8.8.8.8\t53\tudp\tdns\t0.029460\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:55.290Z","host":{"name":"f6b540842a86"},"log":{"offset":417937,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537829 Key: Timestamp: 2025-12-09 15:23:56.977 Headers: empty

{"@version":"1","event":{"hash":"1b3a53bc46209a2a904aa52f71767c4c05e1570b476e9b2117f81199ceff1c75"},"ecs":{"version":"1.6.0"},"message":"1765293834.652063\tCifp8a4HUrSGRvxjg3\t172.30.1.12\t55410\t8.8.8.8\t53\tudp\t12401\t0.003607\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:55.869Z","host":{"name":"f6b540842a86"},"log":{"offset":382301,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537830 Key: Timestamp: 2025-12-09 15:23:56.977 Headers: empty

{"@version":"1","event":{"hash":"bb3cd031721ab3ff3eb245eae35861509e3c13eb658685e9c093f19758986a69"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765284794.887149\tCH28tIK4SiF6fykF2\t172.30.1.222\t64868\t35.189.87.168\t443\ttcp\tssl\t9034.767533\t2582\t5637\tSF\tT\tF\t0\tShADadTTTfF\t222\t11673\t225\t17037\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:56.291Z","host":{"name":"f6b540842a86"},"log":{"offset":418061,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537831 Key: Timestamp: 2025-12-09 15:23:56.977 Headers: empty

{"@version":"1","event":{"hash":"d1ab1572961bc7e781d1d24e4d9a75b9e85c93a52a5ab5e4e13f3b82f7faa792"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765293825.246033\tCJcqml2vAon8Rm8Nce\t172.30.1.12\t34078\t8.8.8.8\t53\tudp\tdns\t0.029776\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:56.291Z","host":{"name":"f6b540842a86"},"log":{"offset":418218,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537832 Key: Timestamp: 2025-12-09 15:23:57.980 Headers: empty

{"@version":"1","event":{"hash":"ba6fb8cad4d77dd28eaadef5f4feafbd3e99c733b8b5abedb8fc73a558a68cee"},"ecs":{"version":"1.6.0"},"message":"1765293835.666207\tChgYk240mGpYl7CRK3\t172.30.1.12\t35000\t8.8.8.8\t53\tudp\t12402\t0.027915\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:56.870Z","host":{"name":"f6b540842a86"},"log":{"offset":382476,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537833 Key: Timestamp: 2025-12-09 15:23:57.980 Headers: empty

{"@version":"1","event":{"hash":"722d3f690cf65ef4a8145a011faba428e9ddf59759cbcb962122780b0bd9bf95"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765293826.286027\tChVKccZ7lJtldJ27j\t172.30.1.12\t42603\t8.8.8.8\t53\tudp\tdns\t0.028323\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:57.291Z","host":{"name":"f6b540842a86"},"log":{"offset":418342,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537834 Key: Timestamp: 2025-12-09 15:23:58.975 Headers: empty

{"@version":"1","event":{"hash":"a7890007aedb21da350c1529289e9ceb0b5b62a4f259ed283d51898bbaa6bf33"},"ecs":{"version":"1.6.0"},"message":"1765293836.696134\tCIbgH9OAIAq2YPxWe\t172.30.1.12\t39164\t8.8.8.8\t53\tudp\t12403\t0.029001\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t118.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:23:57.870Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":382651},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537835 Key: Timestamp: 2025-12-09 15:32:39.389 Headers: empty

{"@version":"1","event":{"hash":"b45aae5d6d4567f4d1e2bf5cc7f3350466af3a021ba56555abbd710b98cbb77f"},"ecs":{"version":"1.6.0"},"message":"1765294348.363832\tFd201b2X5aOhSlN8Z4\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:38.615Z","host":{"name":"f6b540842a86"},"log":{"offset":23976,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537836 Key: Timestamp: 2025-12-09 15:32:39.389 Headers: empty

{"@version":"1","event":{"hash":"7ccf9ac4a7a5e74f461a3bb0c4d7930557491a9a3ed04301fe2b26cdf2ea7bd9"},"ecs":{"version":"1.6.0"},"message":"1765294356.362002\tCmi0JO322QSw4RJDDi\t172.30.1.12\t56379\t8.8.8.8\t53\tudp\t12911\t0.028656\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t233.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:38.286Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":514321},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537837 Key: Timestamp: 2025-12-09 15:32:39.390 Headers: empty

{"@version":"1","event":{"hash":"aaa5ae8ef7a70363d5ea7372248f99be7f11b82e7a162193cc65d9d016cae370"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765294347.061650\tCaiQM71b0Vm6T4Eevg\t172.30.1.12\t41489\t8.8.8.8\t53\tudp\tdns\t0.027525\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:38.855Z","host":{"name":"f6b540842a86"},"log":{"offset":569498,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537838 Key: Timestamp: 2025-12-09 15:32:39.390 Headers: empty

{"@version":"1","event":{"hash":"a8eaf06c9919f722f5d47dd927619a660f9147c77899cbd44aee1ab588b8afd3"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765294347.163457\tC1ko7a24vsExr1x9pa\t172.30.1.35\t58216\t172.30.1.254\t53\tudp\tdns\t0.811647\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:38.855Z","host":{"name":"f6b540842a86"},"log":{"offset":569622,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537839 Key: Timestamp: 2025-12-09 15:32:39.390 Headers: empty

{"@version":"1","event":{"hash":"491d26924342d7fea0703bdb16aece13a6a64dd3bed96596b8dfa1f177b75ac4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765294348.091998\tCerfFG2GEPr9UsMC62\t172.30.1.12\t39806\t8.8.8.8\t53\tudp\tdns\t0.029163\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:38.855Z","host":{"name":"f6b540842a86"},"log":{"offset":569753,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537840 Key: Timestamp: 2025-12-09 15:32:40.391 Headers: empty

{"@version":"1","event":{"hash":"b0d9d9d8d37c9e13464b927495aeb1767375fd848beb0a5b938cc2d7b9df456d"},"ecs":{"version":"1.6.0"},"message":"1765294357.178537\tCuCEng1V2Ptp2ytR85\t172.30.1.35\t61979\t172.30.1.254\t53\tudp\t16437\t0.517073\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2203.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:39.287Z","host":{"name":"f6b540842a86"},"log":{"offset":514657,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537841 Key: Timestamp: 2025-12-09 15:32:40.391 Headers: empty

{"@version":"1","event":{"hash":"0bccc38ba61b32b28dc3d45d2ba8172e47351202bf5e8ecccb407907ae2a8b8f"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765290726.982360\tCPyvmu2Ee8naEaeIwf\t45.164.222.45\t34621\t172.30.1.2\t443\ttcp\t-\t31.366977\t0\t0\tS1\tF\tT\t0\tSh\t1\t52\t6\t312\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:39.855Z","host":{"name":"f6b540842a86"},"log":{"offset":569877,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537842 Key: Timestamp: 2025-12-09 15:32:40.391 Headers: empty

{"@version":"1","event":{"hash":"efe8f98f820b6a325fcedf69dd1651b622f1e1649027a9b5f5e324291e26c64b"},"ecs":{"version":"1.6.0"},"message":"1765294357.263571\tCHrH6B4QnYofB6WRZc\t172.30.1.35\t61979\t8.8.8.8\t53\tudp\t16437\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t810.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:39.287Z","host":{"name":"f6b540842a86"},"log":{"offset":514496,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537843 Key: Timestamp: 2025-12-09 15:32:40.391 Headers: empty

{"@version":"1","event":{"hash":"3846ce67cc21c117b79bb37c4b284438adcc2d3c81960fdc029f160135389956"},"ecs":{"version":"1.6.0"},"message":"1765294357.452196\tCJ6IBP3ETTk7Vhjojh\t172.30.1.12\t44062\t8.8.8.8\t53\tudp\t12912\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t4.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:39.287Z","host":{"name":"f6b540842a86"},"log":{"offset":514831,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537844 Key: Timestamp: 2025-12-09 15:32:41.393 Headers: empty

{"@version":"1","event":{"hash":"2b4d8a3b09e8b933464f7351b841cb1ad51d96e109751adc06a0b6c6481a3316"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765294350.161752\tCtbzcq1Zt6K9gviXP5\t172.30.1.12\t60008\t8.8.8.8\t53\tudp\tdns\t0.029294\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:40.856Z","host":{"name":"f6b540842a86"},"log":{"offset":570129,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1537845 Key: Timestamp: 2025-12-09 15:32:41.393 Headers: empty

{"@version":"1","event":{"hash":"90aa58b717fa2f70a1124e853ab34357fa5e8aa8f6d0839a748a8b9d565365eb"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765294349.131731\tCqU4l51wTmKiVdf7y5\t172.30.1.12\t43781\t8.8.8.8\t53\tudp\tdns\t0.027238\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T15:32:40.856Z","host":{"name":"f6b540842a86"},"log":{"offset":570005,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network