Kafdrop: Topic: logstash-local-network: Messages

Offset: 1500751 Key: Timestamp: 2025-12-06 12:40:18.459 Headers: empty

{"@version":"1","event":{"hash":"908ea6bf3e8e278433e7807f59178593a248ad5a8747516a351b5418561715d0"},"ecs":{"version":"1.6.0"},"message":"1765024817.050329\tCLj3pMHSoDXzuc2Kl\t172.30.1.12\t44666\t172.30.1.254\t53\tudp\t10555\t0.003689\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:18.242Z","host":{"name":"f6b540842a86"},"log":{"offset":575573,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500752 Key: Timestamp: 2025-12-06 12:40:18.459 Headers: empty

{"@version":"1","event":{"hash":"d739bca0ee892b4d610a6c98269d9e6a47c2039bb94defc698a4f3f01f9a6a00"},"ecs":{"version":"1.6.0"},"message":"1765024816.434593\tCnPziC1wIAPbuzUina\t172.30.1.35\t62510\t172.30.1.254\t53\tudp\t41161\t0.003350\tstoreedge.microsoft.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tsfds-geo.xbetservices.akadns.net,storeedge.microsoft.com-v1.edgekey.net,e2784.dscd.akamaiedge.net,184.30.6.252\t2953.000000,55.000000,3600.000000,11.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:18.242Z","host":{"name":"f6b540842a86"},"log":{"offset":574775,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500753 Key: Timestamp: 2025-12-06 12:40:19.459 Headers: empty

{"@version":"1","event":{"hash":"b88a54a1e825da3dd26ae9eb3faa86b854a90180a72cec04a357cc1fffd192f2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024806.950259\tChwvTU3EZKnBjVLYJa\t172.30.1.12\t50967\t172.30.1.254\t53\tudp\tdns\t0.003371\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:18.355Z","host":{"name":"f6b540842a86"},"log":{"offset":639144,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500754 Key: Timestamp: 2025-12-06 12:40:19.459 Headers: empty

{"@version":"1","event":{"hash":"1b793764ca378f3bcf0f131911ea1bd2cea31b7c7cd5fa9fda2340e1449ff069"},"ecs":{"version":"1.6.0"},"message":"1765024818.060316\tCOdhSB1eG9D8h6Fw47\t172.30.1.12\t46821\t172.30.1.254\t53\tudp\t10556\t0.003546\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:19.242Z","host":{"name":"f6b540842a86"},"log":{"offset":575752,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500755 Key: Timestamp: 2025-12-06 12:40:21.347 Headers: empty

{"@version":"1","event":{"hash":"538413ae85ac62d174510c5827190ba89ecdcbd129ae1b6cb4baeee1046578d2"},"ecs":{"version":"1.6.0"},"message":"1765024819.070382\tCuc82n1RLbqVfcfeU\t172.30.1.12\t49295\t172.30.1.254\t53\tudp\t10557\t0.002609\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:20.242Z","host":{"name":"f6b540842a86"},"log":{"offset":575932,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500756 Key: Timestamp: 2025-12-06 12:40:21.347 Headers: empty

{"@version":"1","event":{"hash":"b2b7f7e4a707a693e9fa727a7e38e4588c32b73b3d6e7e09b23feb44b46b3659"},"ecs":{"version":"1.6.0"},"message":"1765024818.717024\tC45E7X3Pwt3TBTQzcl\t172.30.1.35\t65523\t8.8.8.8\t53\tudp\t18787\t0.021842\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3011.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.244Z","host":{"name":"f6b540842a86"},"log":{"offset":576111,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500757 Key: Timestamp: 2025-12-06 12:40:21.348 Headers: empty

{"@version":"1","event":{"hash":"55eabb4c62c8f36cf6238d2f44c84499f4509c6b30b0497bb82cdb2cf85b097a"},"ecs":{"version":"1.6.0"},"message":"1765024818.669100\tCCV7eoCdM1avfciIi\t172.30.1.35\t65523\t172.30.1.254\t53\tudp\t18787\t0.466927\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3055.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.244Z","host":{"name":"f6b540842a86"},"log":{"offset":576280,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500758 Key: Timestamp: 2025-12-06 12:40:22.460 Headers: empty

{"@version":"1","event":{"hash":"fab061a767bcf655983bf712d5bf6d771077c1d8e0a69075bf1098973c01c8a8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024807.960345\tCBifcc45p5stHVH2Oc\t172.30.1.12\t60173\t172.30.1.254\t53\tudp\tdns\t0.002559\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.356Z","host":{"name":"f6b540842a86"},"log":{"offset":639273,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500759 Key: Timestamp: 2025-12-06 12:40:22.461 Headers: empty

{"@version":"1","event":{"hash":"33083ffb6abaf07e921407f424d04d5663fd3bae8de8d25d4e26043e1773ffda"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024808.675661\tCm3EjGTTQSxoQwN2d\t172.30.1.35\t57138\t172.30.1.254\t53\tudp\tdns\t0.046039\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.356Z","host":{"name":"f6b540842a86"},"log":{"offset":639402,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500760 Key: Timestamp: 2025-12-06 12:40:22.461 Headers: empty

{"@version":"1","event":{"hash":"751e90f27f78e25fd8c5f78cf60ae70dbbb64d053be3ebac1bfc81ea8d7f155a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024808.716920\tCqCtzW3VEdrOC0AQyf\t172.30.1.35\t57138\t8.8.8.8\t53\tudp\tdns\t0.029507\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.356Z","host":{"name":"f6b540842a86"},"log":{"offset":639532,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500761 Key: Timestamp: 2025-12-06 12:40:22.461 Headers: empty

{"@version":"1","event":{"hash":"e93900ad04b199627417bfb183bc86a8098421e9fa8b5a5734b5187072766021"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024808.970235\tCtLFxiKSPq18lftsd\t172.30.1.12\t46000\t172.30.1.254\t53\tudp\tdns\t0.002708\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.356Z","host":{"name":"f6b540842a86"},"log":{"offset":639658,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500762 Key: Timestamp: 2025-12-06 12:40:22.461 Headers: empty

{"@version":"1","event":{"hash":"a006f05b4b24c67246eb48a346c4f151ab908115c785463bb1409cd05e447d5c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024809.980280\tCZI79g3yGr17L6X4g3\t172.30.1.12\t39788\t172.30.1.254\t53\tudp\tdns\t0.002688\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:21.356Z","host":{"name":"f6b540842a86"},"log":{"offset":639786,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500763 Key: Timestamp: 2025-12-06 12:40:22.461 Headers: empty

{"@version":"1","event":{"hash":"248cc78a6d280294191f285a2c9f1cc96e5fc57ca7a9e80837f6f07c899297f2"},"ecs":{"version":"1.6.0"},"message":"1765024820.088737\tCBYzsb3SD5S7MZEfJk\t172.30.1.12\t33981\t172.30.1.254\t53\tudp\t10558\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:22.244Z","host":{"name":"f6b540842a86"},"log":{"offset":576453,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500764 Key: Timestamp: 2025-12-06 12:40:24.349 Headers: empty

{"@version":"1","event":{"hash":"5679028454538058d905aafb574f377ac8c7b9f51ee668ee22aae62026fe3ad2"},"ecs":{"version":"1.6.0"},"message":"1765024821.090350\tCSHfuV1HZCjLnfGKSj\t172.30.1.12\t54319\t172.30.1.254\t53\tudp\t10559\t0.002759\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:23.245Z","host":{"name":"f6b540842a86"},"log":{"offset":576626,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500765 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"047b5473ea55ac3efe560326e3a11405562b0eabcf8265003adaca51ec27564c"},"ecs":{"version":"1.6.0"},"message":"1765024822.100369\tCEQL8v4nrDtXTzDTda\t172.30.1.12\t37488\t172.30.1.254\t53\tudp\t10560\t0.002812\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.245Z","host":{"name":"f6b540842a86"},"log":{"offset":576806,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500766 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"48e8ac27084c40cf4b51bd4db7453256cc4c6a7e56597196b5bb437c2eb57d60"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024810.990368\tC3dFew23SGubHpMYA1\t172.30.1.12\t52181\t172.30.1.254\t53\tudp\tdns\t0.002734\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.358Z","host":{"name":"f6b540842a86"},"log":{"offset":639915,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500767 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"2c17f9be9d685f04052122cf882dccb27f092546b034b06f52365d23fd01ebb1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024735.491402\tCMutXkVamKbWLBfnh\t172.30.1.35\t52359\t142.250.204.131\t443\tudp\t-\t25.150095\t8625\t11324\tSF\tT\tF\t0\tDd\t19\t9157\t21\t11912\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.358Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":640044},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500768 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"063e5090d961faa0476b44e942cf2553511dd52c2f2342707a2bc80b5f3c394f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024762.045288\tCimQOd2ifOUxNYmSvd\t172.30.1.132\t34093\t216.239.35.12\t123\tudp\tntp\t0.030975\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.358Z","host":{"name":"f6b540842a86"},"log":{"offset":640187,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500769 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"7a4e5f951c4e5b47e5041b842ac5d74cce0cdac5a8683af0f60d0f44cee6e988"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024812.000294\tCH0QIS1z4F3ii6ief\t172.30.1.12\t53883\t172.30.1.254\t53\tudp\tdns\t0.002811\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.358Z","host":{"name":"f6b540842a86"},"log":{"offset":640319,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500770 Key: Timestamp: 2025-12-06 12:40:25.350 Headers: empty

{"@version":"1","event":{"hash":"6d3b4fe767a3224391cdeede3dfb09bf0eb7bd3043a1f556fff1bc5988c478cd"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024813.010448\tCDHF1v1HvgRePczde3\t172.30.1.12\t45026\t172.30.1.254\t53\tudp\tdns\t0.002694\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:24.359Z","host":{"name":"f6b540842a86"},"log":{"offset":640447,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500771 Key: Timestamp: 2025-12-06 12:40:26.349 Headers: empty

{"@version":"1","event":{"hash":"f3d5557cb4e4cf045ffb0c572eb33956486ab676e2cb3570fd5f114570d54b94"},"ecs":{"version":"1.6.0"},"message":"1765024823.110533\tCxb0qx3dbr28j2XEvj\t172.30.1.12\t34845\t172.30.1.254\t53\tudp\t10561\t0.006412\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.245Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":576986},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500772 Key: Timestamp: 2025-12-06 12:40:26.350 Headers: empty

{"@version":"1","event":{"hash":"1c754262e6c32e3107c9ba72f5199410f92d99961e4b415c0de8d2f66c7a704e"},"ecs":{"version":"1.6.0"},"message":"1765024823.676927\tCIm8p22QHNQFuieHai\t172.30.1.35\t54048\t172.30.1.254\t53\tudp\t37348\t0.005186\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3051.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.246Z","host":{"name":"f6b540842a86"},"log":{"offset":577166,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500773 Key: Timestamp: 2025-12-06 12:40:26.350 Headers: empty

{"@version":"1","event":{"hash":"389a9dd7b5a57585006bcd6b484a0623512b58cfe99d90bb813c6d3e52e37be7"},"ecs":{"version":"1.6.0"},"message":"1765024824.120420\tC9M65U1zCoxcVWov6k\t172.30.1.12\t42470\t172.30.1.254\t53\tudp\t10562\t0.003144\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.246Z","host":{"name":"f6b540842a86"},"log":{"offset":577340,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500774 Key: Timestamp: 2025-12-06 12:40:26.350 Headers: empty

{"@version":"1","event":{"hash":"114c410ed7a4ca3ed75b2965df092c44beac2b6d4a3828088e804dd414413c63"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024818.262404\tCvYuUG1jupJoS5jbl3\t172.30.2.16\t62130\t172.30.1.35\t7680\ttcp\t-\t0.004355\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.360Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":640576},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500775 Key: Timestamp: 2025-12-06 12:40:26.350 Headers: empty

{"@version":"1","event":{"hash":"22e8bd5509b0e55d4c7ef83b3fc510ea7704f3feea716392fac8ee5af5daf4b4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024813.714799\tC7a9hn1JQSQnt4Axj3\t172.30.1.35\t64327\t8.8.8.8\t53\tudp\tdns\t0.029245\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.360Z","host":{"name":"f6b540842a86"},"log":{"offset":640710,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500776 Key: Timestamp: 2025-12-06 12:40:26.350 Headers: empty

{"@version":"1","event":{"hash":"bdf60ef35790a3d949b152119d2d59bec5bc894113c2aa937ad35b4a296fca7f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024813.673925\tCsQMwDa1wIq3XPCA7\t172.30.1.35\t64327\t172.30.1.254\t53\tudp\tdns\t0.332599\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:25.360Z","host":{"name":"f6b540842a86"},"log":{"offset":640836,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500777 Key: Timestamp: 2025-12-06 12:40:27.464 Headers: empty

{"@version":"1","event":{"hash":"26525c3bf9a74b9bfbd7c71a98bd12907d1ee3e082d3162d4ad52137e23acf32"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024814.021105\tCNj2tgkwe0u8Mbgej\t172.30.1.12\t42288\t172.30.1.254\t53\tudp\tdns\t0.002325\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:26.360Z","host":{"name":"f6b540842a86"},"log":{"offset":640966,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500778 Key: Timestamp: 2025-12-06 12:40:27.464 Headers: empty

{"@version":"1","event":{"hash":"510fa75d40e7730c68fd26765683d2aa2ff8413f4a85c28bd4348a142289f284"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024815.030434\tCDUPVf10wisvPphNda\t172.30.1.12\t54196\t172.30.1.254\t53\tudp\tdns\t0.003145\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:26.360Z","host":{"name":"f6b540842a86"},"log":{"offset":641094,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500779 Key: Timestamp: 2025-12-06 12:40:27.464 Headers: empty

{"@version":"1","event":{"hash":"cb68770587df52e5bdd3e11a95e0ef13b808be500c9c174527e24c4eb8164be3"},"ecs":{"version":"1.6.0"},"message":"1765024816.578402\tCTzDyD2iKquwOZxTs\t172.30.1.35\t56071\t20.190.163.20\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp384r1\tlogin.live.com\tF\t-\t-\tT\tFxi6cZ1lx2x68zj0E9,FxbPLo1vv7uGAqL5xf\t(empty)\tCN=login.live.com,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\tCN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US\t-\t-\tok\t28a2c9bd18a11de089ef85a160da29e4\t7d8fd34fdb13a7fff30d5a52846b6c4c","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.357Z","host":{"name":"f6b540842a86"},"log":{"offset":37670,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500780 Key: Timestamp: 2025-12-06 12:40:27.464 Headers: empty

{"@version":"1","event":{"hash":"dc3e03676d09337f38f24b8db81dca6eecf1548ade8dd4594a44227f46f2bf9a"},"ecs":{"version":"1.6.0"},"message":"1765024816.445143\tCi5Owy4w764SSQGavh\t172.30.1.35\t56070\t184.30.6.252\t443\tTLSv12\tTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\tsecp256r1\tstoreedge.microsoft.com\tF\t-\thttp/1.1\tT\tFSWvT537rnrxuhMkS4,FBdS7S1u71NYS1Q14h\t(empty)\tCN=storeedge.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure ECC TLS Issuing CA 03,O=Microsoft Corporation,C=US\t-\t-\tok\t28a2c9bd18a11de089ef85a160da29e4\t42ec7b1db61428bf1cc6e01b9ef02b04","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.357Z","host":{"name":"f6b540842a86"},"log":{"offset":37241,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500781 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"be012a96359860655047c9e06c9b34565fa5324debc116ffacf7b0ae808965bf"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024816.040550\tCECNHa1F1dXjs9Lzsc\t172.30.1.12\t45890\t172.30.1.254\t53\tudp\tdns\t0.003193\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.360Z","host":{"name":"f6b540842a86"},"log":{"offset":641347,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500782 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"9822bafa07a0eb09f339d960c7bae0215a998c7ed69fe296e1b3fdfba66005df"},"ecs":{"version":"1.6.0"},"message":"1765024816.448920\tFSWvT537rnrxuhMkS4\t3\t3300010A516F26FB8DEFE659E8000000010A51\tCN=storeedge.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure ECC TLS Issuing CA 03,O=Microsoft Corporation,C=US\t1750084696.000000\t1781188696.000000\tid-ecPublicKey\tecdsa-with-SHA384\tecdsa\t256\t-\tprime256v1\tcn.storeedge.microsoft.com,net.storeedge.microsoft.com,storeedge.microsoft.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.374Z","host":{"name":"f6b540842a86"},"log":{"offset":36151,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500783 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"49928574468d09fd799eb6c0a5f363533377c01139c2b07facb492ef9a3280a3"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024816.434593\tCnPziC1wIAPbuzUina\t172.30.1.35\t62510\t172.30.1.254\t53\tudp\tdns\t0.003350\t41\t188\tSF\tT\tT\t0\tDd\t1\t69\t1\t216\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.360Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":641476},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500784 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"b1cc765218c446e578d4dbe3c1e873ce6cdbcb2fb765d63ef2fc73c7d378a0f1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024820.659144\tCvPGsnYTVOGCPeny9\t172.30.1.2\t40332\t172.30.4.139\t1514\ttcp\t-\t2.999111\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.360Z","host":{"name":"f6b540842a86"},"log":{"offset":641223,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500785 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"2ac8596a902ab5868915723b75ed35050d392b48035f64d7f18c5833a4d782bf"},"ecs":{"version":"1.6.0"},"message":"1765024816.607301\tFxi6cZ1lx2x68zj0E9\t3\t035B9C9DAFF3128C8D65536289DA2589\tCN=login.live.com,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\tCN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US\t1761177600.000000\t1776815999.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tlogin.live.com,*.login.live.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:27.374Z","host":{"name":"f6b540842a86"},"log":{"offset":36552,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500786 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"d8641ba9c5bd18db7d31e79ba86110585e72ad69fb7f11afed01b5c462f51f88"},"ecs":{"version":"1.6.0"},"message":"1765024825.130474\tCSabQw4duKPbwc6WYc\t172.30.1.12\t52243\t172.30.1.254\t53\tudp\t10563\t0.002896\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:28.246Z","host":{"name":"f6b540842a86"},"log":{"offset":577520,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500787 Key: Timestamp: 2025-12-06 12:40:28.465 Headers: empty

{"@version":"1","event":{"hash":"365a45a069f1ebd689967d317e50302dce5f2b05c088e9d78318d32ba2d93152"},"ecs":{"version":"1.6.0"},"message":"1765024826.177757\tCdPAfV1sPVZuv25oxi\t172.30.1.12\t38071\t172.30.1.254\t53\tudp\t10564\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:28.246Z","host":{"name":"f6b540842a86"},"log":{"offset":577700,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500788 Key: Timestamp: 2025-12-06 12:40:29.465 Headers: empty

{"@version":"1","event":{"hash":"5889aacdcd8614883c14e58d9c17a4fa7386fa6112caf6b69618986cf75f4e48"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024820.792605\tCxxu8Y1EblK85zxuJ3\t172.30.1.2\t48006\t172.30.4.136\t5044\ttcp\t-\t2.995603\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:28.361Z","host":{"name":"f6b540842a86"},"log":{"offset":641607,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500789 Key: Timestamp: 2025-12-06 12:40:29.465 Headers: empty

{"@version":"1","event":{"hash":"8945f0f9ffea5c8371333c8150641aa4759031a48bdfcfc74875e6d89aec46d3"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024816.542665\tCWpdT34J4i9rsznYk1\t172.30.1.35\t54590\t172.30.1.254\t53\tudp\tdns\t0.004068\t32\t302\tSF\tT\tT\t0\tDd\t1\t60\t1\t330\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:28.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":641732},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500790 Key: Timestamp: 2025-12-06 12:40:29.465 Headers: empty

{"@version":"1","event":{"hash":"920f0d85da56b008d7e39cb62cf38ef4cfb0d6cd5118340db0fe0b5f7107d7f1"},"ecs":{"version":"1.6.0"},"message":"1765024827.150384\tCY94tT3TLvRfPYD4td\t172.30.1.12\t58497\t172.30.1.254\t53\tudp\t10565\t0.002752\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:29.247Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":577873},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500791 Key: Timestamp: 2025-12-06 12:40:30.467 Headers: empty

{"@version":"1","event":{"hash":"53f7261d3a0fb8a7d0d57158a7e506cc3492dc8aa4a79ebc80e91f7c35f2de6a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024817.050329\tCLj3pMHSoDXzuc2Kl\t172.30.1.12\t44666\t172.30.1.254\t53\tudp\tdns\t0.003689\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:29.361Z","host":{"name":"f6b540842a86"},"log":{"offset":641993,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500792 Key: Timestamp: 2025-12-06 12:40:30.467 Headers: empty

{"@version":"1","event":{"hash":"677394d3bbc5cf3a366f5ff1bcb844a9068a53c672d6406c1d393a1fcbe0a8bc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024766.849742\tCNC5lF1g4QGYK4w46d\t172.30.1.2\t60452\t147.50.17.138\t123\tudp\tntp\t0.006553\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:29.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":641863},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500793 Key: Timestamp: 2025-12-06 12:40:30.467 Headers: empty

{"@version":"1","event":{"hash":"c42e7aef73f2a64e7d795c80c10e1980ebde6c3f667539801fb5524d18ee6572"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024818.060316\tCOdhSB1eG9D8h6Fw47\t172.30.1.12\t46821\t172.30.1.254\t53\tudp\tdns\t0.003546\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:29.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":642121},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500794 Key: Timestamp: 2025-12-06 12:40:30.467 Headers: empty

{"@version":"1","event":{"hash":"c991fb1ce5af14115ee9777eee2b2dc7d038ca610c9dd5ff4674e5577fe80cff"},"ecs":{"version":"1.6.0"},"message":"1765024828.672889\tCA7EPz0BQe8aOstt\t172.30.1.35\t52349\t172.30.1.254\t53\tudp\t17826\t0.028363\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3046.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:30.248Z","host":{"name":"f6b540842a86"},"log":{"offset":578053,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500795 Key: Timestamp: 2025-12-06 12:40:30.467 Headers: empty

{"@version":"1","event":{"hash":"cec696b86ef6733a67cf03fd8ca6b408b51b78e6281e6672cb69f3a8d86ddb9c"},"ecs":{"version":"1.6.0"},"message":"1765024828.160417\tCL9xOh3hUcH19pFxck\t172.30.1.12\t51518\t172.30.1.254\t53\tudp\t10566\t0.003524\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:30.248Z","host":{"name":"f6b540842a86"},"log":{"offset":578225,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500796 Key: Timestamp: 2025-12-06 12:40:32.358 Headers: empty

{"@version":"1","event":{"hash":"833920c7b6d3062ea5c640a3f6d732ea6b6b990abce01258d57d84c067383dd5"},"ecs":{"version":"1.6.0"},"message":"1765024829.170550\tCBcRDG1bbetII4UG74\t172.30.1.12\t33178\t172.30.1.254\t53\tudp\t10567\t0.003587\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:31.249Z","host":{"name":"f6b540842a86"},"log":{"offset":578405,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500797 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"e245bf844106da17bf397f0ff4b1628ec1dfefcd4826a7a7466e58608a8ce5d3"},"ecs":{"version":"1.6.0"},"message":"1765024830.184427\tCG9dVT15IXR0kGG7Bk\t172.30.1.12\t52781\t172.30.1.254\t53\tudp\t10568\t0.000258\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.252Z","host":{"name":"f6b540842a86"},"log":{"offset":578585,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500798 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"afb50240fb0040d6e630ed71d9c00d376902aed6ff923e7eea97642356160f6c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024818.669100\tCCV7eoCdM1avfciIi\t172.30.1.35\t65523\t172.30.1.254\t53\tudp\tdns\t0.457379\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"offset":642250,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500799 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"32ef56b1ce4cc42e736de41d6c08eac50e957c7474b4059e622ef49591d0e3a5"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024818.711444\tC45E7X3Pwt3TBTQzcl\t172.30.1.35\t65523\t8.8.8.8\t53\tudp\tdns\t0.027422\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"offset":642508,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500800 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"37d8641075b403193228f41ffeb8ee24c92b5fe07ecd7749f9646d8f10d38cee"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024819.070382\tCuc82n1RLbqVfcfeU\t172.30.1.12\t49295\t172.30.1.254\t53\tudp\tdns\t0.002609\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":642380},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500801 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"a43bb859b02e8e0c91cc2709367c306a11bfcdc79a25a2ae9d4388266da27ea8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024769.201931\tCl9ybH3bV3Qgnh4sJ7\t10.10.10.1\t55086\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"offset":642634,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500802 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"9e75f89f162fb8a967d053751189367149e1bbce7930b5971f8fb978971b111d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024769.202153\tC1CiJI1BoWwnQoZGeh\t172.30.1.4\t52072\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"offset":642755,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500803 Key: Timestamp: 2025-12-06 12:40:33.362 Headers: empty

{"@version":"1","event":{"hash":"8322fc6f57ebf7300d07b164c008de118b6bf91f09fd4cf8ccab80415abad199"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024820.080341\tCBYzsb3SD5S7MZEfJk\t172.30.1.12\t33981\t172.30.1.254\t53\tudp\tdns\t0.002854\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:32.363Z","host":{"name":"f6b540842a86"},"log":{"offset":642876,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500804 Key: Timestamp: 2025-12-06 12:40:34.360 Headers: empty

{"@version":"1","event":{"hash":"e7f33dc5a4d65cbba2a3943ff4c9109ddcc19f3e1e5e7202f314f55fc7ee47b6"},"ecs":{"version":"1.6.0"},"message":"1765024831.192275\tCb9iYn3MSoKQHaAxwi\t172.30.1.12\t39846\t172.30.1.254\t53\tudp\t10569\t0.000877\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:33.256Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":578765},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500805 Key: Timestamp: 2025-12-06 12:40:34.360 Headers: empty

{"@version":"1","event":{"hash":"a20ae3cb8225686268cdb7abb187d01c890165c879dad71d4a7b433718de6f37"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024821.090350\tCSHfuV1HZCjLnfGKSj\t172.30.1.12\t54319\t172.30.1.254\t53\tudp\tdns\t0.002759\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:33.363Z","host":{"name":"f6b540842a86"},"log":{"offset":643005,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500806 Key: Timestamp: 2025-12-06 12:40:35.363 Headers: empty

{"@version":"1","event":{"hash":"a8676f3996884c7b8b90fdaf4994c5629471fbf8ea9720bdfdf5f88715e5275c"},"ecs":{"version":"1.6.0"},"message":"1765024830.834987\tCw8zfG2TixAvTmc7l9\t202.46.62.10\t9765\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tFaq3SaT8bDiAGnk5k,FMsFSzsHVOMCZj5qc\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:34.362Z","host":{"name":"f6b540842a86"},"log":{"offset":38064,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500807 Key: Timestamp: 2025-12-06 12:40:35.363 Headers: empty

{"@version":"1","event":{"hash":"acc720c3a6e89b48bddfdec52c67840f23fc5286475fedb5c843f1929f8d7612"},"ecs":{"version":"1.6.0"},"message":"1765024832.200481\tCAQct51anQqGO6ATdb\t172.30.1.12\t56555\t172.30.1.254\t53\tudp\t10570\t0.003111\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:34.257Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":578945},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500808 Key: Timestamp: 2025-12-06 12:40:35.363 Headers: empty

{"@version":"1","event":{"hash":"09fcd09f624553c1308da80f02ff03ffff3560c2fc43a8cb4fc67e15bbecdb0d"},"ecs":{"version":"1.6.0"},"message":"1765024830.840088\tFaq3SaT8bDiAGnk5k\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:34.375Z","host":{"name":"f6b540842a86"},"log":{"offset":36882,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500809 Key: Timestamp: 2025-12-06 12:40:35.364 Headers: empty

{"@version":"1","event":{"hash":"e8ac46d175c78b9ba1232c6567b05f5a290015b645e0a3384572361a42f7cebf"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024822.100369\tCEQL8v4nrDtXTzDTda\t172.30.1.12\t37488\t172.30.1.254\t53\tudp\tdns\t0.002812\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:34.364Z","host":{"name":"f6b540842a86"},"log":{"offset":643134,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500810 Key: Timestamp: 2025-12-06 12:40:36.364 Headers: empty

{"@version":"1","event":{"hash":"f98f9791c8ee1f7265c8113fa77a55cda29c4af0d68d8c0c11418db33f8a99ab"},"ecs":{"version":"1.6.0"},"message":"1765024833.211809\tCprMoU3j5YbPctiZi3\t172.30.1.12\t51328\t172.30.1.254\t53\tudp\t10571\t0.002863\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:35.258Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":579125},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500811 Key: Timestamp: 2025-12-06 12:40:36.364 Headers: empty

{"@version":"1","event":{"hash":"944a6dbc4c5926de3b8be603e6c172d042ba3b212c1d034c2bd3e822bbd06ded"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024770.459710\tCpCall4B4CvalBTPE1\t172.30.1.222\t54600\t239.255.255.250\t1900\tudp\t-\t3.020833\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:35.364Z","host":{"name":"f6b540842a86"},"log":{"offset":643392,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500812 Key: Timestamp: 2025-12-06 12:40:36.364 Headers: empty

{"@version":"1","event":{"hash":"2bbb5148f1696827ae699fa54aa96c16fc38940d84e949aa412ff649d2304e64"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024823.110533\tCxb0qx3dbr28j2XEvj\t172.30.1.12\t34845\t172.30.1.254\t53\tudp\tdns\t0.006412\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:35.364Z","host":{"name":"f6b540842a86"},"log":{"offset":643263,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500813 Key: Timestamp: 2025-12-06 12:40:36.364 Headers: empty

{"@version":"1","event":{"hash":"b4fbd4ed9a30c31b104771df826bac339dd6ca9b53dda296eae81dcb19e1c68d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024823.676927\tCIm8p22QHNQFuieHai\t172.30.1.35\t54048\t172.30.1.254\t53\tudp\tdns\t0.005186\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:35.364Z","host":{"name":"f6b540842a86"},"log":{"offset":643524,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500814 Key: Timestamp: 2025-12-06 12:40:37.365 Headers: empty

{"@version":"1","event":{"hash":"7013ad5cb6f4d763c7478c5e5feb8441327b2e612592c36fab2161d65e1d8c3b"},"ecs":{"version":"1.6.0"},"message":"1765024833.791444\tCTOVGd2FwCtahhfYNh\t172.30.1.35\t53002\t8.8.8.8\t53\tudp\t60085\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2996.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:36.261Z","host":{"name":"f6b540842a86"},"log":{"offset":579305,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500815 Key: Timestamp: 2025-12-06 12:40:37.365 Headers: empty

{"@version":"1","event":{"hash":"ba8f42f0da7e8a4b9df3abf0badcfa6a6d94ec3e26029464b9ecb2687f7aa8d9"},"ecs":{"version":"1.6.0"},"message":"1765024834.268770\tCSUlXRIDudnAYC5h6\t172.30.1.12\t59907\t172.30.1.254\t53\tudp\t10572\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:36.261Z","host":{"name":"f6b540842a86"},"log":{"offset":579467,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500816 Key: Timestamp: 2025-12-06 12:40:37.365 Headers: empty

{"@version":"1","event":{"hash":"f83ff4dc1ec3bba06ba6d16f3744d2ab36c5a896b138cfacd522beb1c0073cdb"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024824.120420\tC9M65U1zCoxcVWov6k\t172.30.1.12\t42470\t172.30.1.254\t53\tudp\tdns\t0.003144\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:36.364Z","host":{"name":"f6b540842a86"},"log":{"offset":643655,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500817 Key: Timestamp: 2025-12-06 12:40:37.365 Headers: empty

{"@version":"1","event":{"hash":"0b0ebe6ec22ad9965f33516b65fa47e5dca6d3260763c348b373847ad9dac3fa"},"ecs":{"version":"1.6.0"},"message":"1765024830.423457\tCUByNy1tS4GyAyVzy\t202.46.62.6\t28121\t172.30.1.2\t80\t1\t-\t-\t-\t-\t1.1\t-\t-\t0\t265\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFN0nAAeYx7ElfT5Re\t-\ttext/html","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:36.404Z","host":{"name":"f6b540842a86"},"log":{"offset":24458,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500818 Key: Timestamp: 2025-12-06 12:40:38.366 Headers: empty

{"@version":"1","event":{"hash":"5df4801e7c3eebbcba17a9fca8edf05dc3711362ad0a2a9a3a3c9e61425e57b2"},"ecs":{"version":"1.6.0"},"message":"1765024833.672424\tCSw3Jk277trtH0vIrf\t172.30.1.35\t53002\t172.30.1.254\t53\tudp\t60085\t1.765601\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3039.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:37.261Z","host":{"name":"f6b540842a86"},"log":{"offset":579639,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500819 Key: Timestamp: 2025-12-06 12:40:38.366 Headers: empty

{"@version":"1","event":{"hash":"21b0fae17ef1a47b91f3c2f8216ef9da1af9ed038e71e7384a76eab22b9eb0c5"},"ecs":{"version":"1.6.0"},"message":"1765024835.230558\tCWrLon1LOwXStt1j81\t172.30.1.12\t38123\t172.30.1.254\t53\tudp\t10573\t0.003267\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:37.261Z","host":{"name":"f6b540842a86"},"log":{"offset":579813,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500820 Key: Timestamp: 2025-12-06 12:40:38.366 Headers: empty

{"@version":"1","event":{"hash":"44aada87080ee2cb2edeb1c4db0eca880be817104fa95881af3949961b218b32"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024825.130474\tCSabQw4duKPbwc6WYc\t172.30.1.12\t52243\t172.30.1.254\t53\tudp\tdns\t0.002896\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:37.365Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":643784},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500821 Key: Timestamp: 2025-12-06 12:40:38.366 Headers: empty

{"@version":"1","event":{"hash":"8c5704cd1ac5e51b853cd2d969036c144dbc4b512b70a0caf182432f425459b2"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024830.241890\tCUByNy1tS4GyAyVzy\t202.46.62.6\t28121\t172.30.1.2\t80\ttcp\t-\t0.378557\t311\t510\tSF\tF\tT\t312\tShaGdfADF\t8\t735\t7\t882\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:37.365Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":643913},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500822 Key: Timestamp: 2025-12-06 12:40:39.365 Headers: empty

{"@version":"1","event":{"hash":"bc5f315048673a7a0e6f709a729cfb82b445c144bf62766868684890d2c43e49"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024826.140437\tCdPAfV1sPVZuv25oxi\t172.30.1.12\t38071\t172.30.1.254\t53\tudp\tdns\t0.003624\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:38.366Z","host":{"name":"f6b540842a86"},"log":{"offset":644050,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500823 Key: Timestamp: 2025-12-06 12:40:39.365 Headers: empty

{"@version":"1","event":{"hash":"6fec56a9f45747eae0af9c01d73c14a793603108a1dbe8d060009663f3955796"},"ecs":{"version":"1.6.0"},"message":"1765024836.240532\tCcTvSt3OGrmlkongli\t172.30.1.12\t50641\t172.30.1.254\t53\tudp\t10574\t0.002723\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:38.262Z","host":{"name":"f6b540842a86"},"log":{"offset":579993,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500824 Key: Timestamp: 2025-12-06 12:40:40.366 Headers: empty

{"@version":"1","event":{"hash":"a065ff46d139029c79dad1e6bd0dfcaa2510135138808071295d9670ce3d5eac"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024827.150384\tCY94tT3TLvRfPYD4td\t172.30.1.12\t58497\t172.30.1.254\t53\tudp\tdns\t0.002752\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:39.366Z","host":{"name":"f6b540842a86"},"log":{"offset":644179,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500825 Key: Timestamp: 2025-12-06 12:40:40.366 Headers: empty

{"@version":"1","event":{"hash":"46331a528beafdc3cbf8a8f3c11b107deda1abd3b403d0ddcc811f265a227835"},"ecs":{"version":"1.6.0"},"message":"1765024837.250613\tC3vsPQ1YxZYNitJ99j\t172.30.1.12\t36164\t172.30.1.254\t53\tudp\t10575\t0.003267\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:39.262Z","host":{"name":"f6b540842a86"},"log":{"offset":580173,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500826 Key: Timestamp: 2025-12-06 12:40:40.366 Headers: empty

{"@version":"1","event":{"hash":"96de85220c2c4404df890d7001466fe0bb946105f188b4580515e1cf5c0a15fb"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024828.160417\tCL9xOh3hUcH19pFxck\t172.30.1.12\t51518\t172.30.1.254\t53\tudp\tdns\t0.003524\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:39.367Z","host":{"name":"f6b540842a86"},"log":{"offset":644308,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500827 Key: Timestamp: 2025-12-06 12:40:41.367 Headers: empty

{"@version":"1","event":{"hash":"e3a5a7fb4e5e209f77593611e8359271b850df6925b71bb6589600309529e99e"},"ecs":{"version":"1.6.0"},"message":"1765024838.261009\tClHF0uhH82w1OkM1g\t172.30.1.12\t52492\t172.30.1.254\t53\tudp\t10576\t0.003123\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:40.263Z","host":{"name":"f6b540842a86"},"log":{"offset":580353,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500828 Key: Timestamp: 2025-12-06 12:40:41.367 Headers: empty

{"@version":"1","event":{"hash":"9b015d5a83109ffe0fa32e925721c655abb2ae083f3abae8f2335cdc2f9e2e5b"},"ecs":{"version":"1.6.0"},"message":"1765024838.675694\tCc2kN640i30ZVA2oi7\t172.30.1.35\t53353\t172.30.1.254\t53\tudp\t61293\t0.005161\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3036.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:40.263Z","host":{"name":"f6b540842a86"},"log":{"offset":580532,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500829 Key: Timestamp: 2025-12-06 12:40:41.367 Headers: empty

{"@version":"1","event":{"hash":"1e0c027868a0a3d5a22d4406447ee0b5af29a3472a629fd0ee110235a51c256e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024828.672889\tCA7EPz0BQe8aOstt\t172.30.1.35\t52349\t172.30.1.254\t53\tudp\tdns\t0.028363\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:40.367Z","host":{"name":"f6b540842a86"},"log":{"offset":644437,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500830 Key: Timestamp: 2025-12-06 12:40:41.368 Headers: empty

{"@version":"1","event":{"hash":"30284330e10a66c0ab26b45e817aced3b2f19fa3f810a928eba3c7084ac4efbd"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024833.659157\tCm9pnshfizw6o8b84\t172.30.1.2\t40336\t172.30.4.139\t1514\ttcp\t-\t3.005108\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:40.367Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":644566},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500831 Key: Timestamp: 2025-12-06 12:40:41.368 Headers: empty

{"@version":"1","event":{"hash":"dc7bf621345d04d65bd786db88d41d283b7746e171f64dd41997bf86a9c79c47"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024830.660731\tCw8zfG2TixAvTmc7l9\t202.46.62.10\t9765\t172.30.1.2\t443\ttcp\tssl\t3.344086\t1082\t19037\tRSTO\tF\tT\t0\t^hSADadtTfR\t24\t2738\t29\t32431\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:40.367Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":644690},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500832 Key: Timestamp: 2025-12-06 12:40:42.367 Headers: empty

{"@version":"1","event":{"hash":"97ae8fa150af3249ff5354c3e211d9a31673b23e3ed224cd06b5ba341c5a4c3f"},"ecs":{"version":"1.6.0"},"message":"1765024839.270532\tC2NhA826kfFCq42Ts3\t172.30.1.12\t37301\t172.30.1.254\t53\tudp\t10577\t0.002946\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:41.264Z","host":{"name":"f6b540842a86"},"log":{"offset":580706,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500833 Key: Timestamp: 2025-12-06 12:40:42.368 Headers: empty

{"@version":"1","event":{"hash":"8b7f258ba0829be3ce3797ade01ab28e82aa9502f939f8dddbb97f96987fd13d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024829.170550\tCBcRDG1bbetII4UG74\t172.30.1.12\t33178\t172.30.1.254\t53\tudp\tdns\t0.003587\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:41.367Z","host":{"name":"f6b540842a86"},"log":{"offset":644841,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500834 Key: Timestamp: 2025-12-06 12:40:43.368 Headers: empty

{"@version":"1","event":{"hash":"79529d4bf365735f1026aa322884981dde9216285c75d1a72992f513f43beb7c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024830.184427\tCG9dVT15IXR0kGG7Bk\t172.30.1.12\t52781\t172.30.1.254\t53\tudp\tdns\t0.000258\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:42.368Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":644970},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500835 Key: Timestamp: 2025-12-06 12:40:43.368 Headers: empty

{"@version":"1","event":{"hash":"806df503f9079ac6207b45f33a934dc29b97eaa6db6ed2d02d2abd91143bc53f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024777.685891\tCAatscszfl5nACOig\t172.30.1.98\t55340\t239.255.255.250\t1900\tudp\t-\t3.045010\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:42.368Z","host":{"name":"f6b540842a86"},"log":{"offset":645099,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500836 Key: Timestamp: 2025-12-06 12:40:43.368 Headers: empty

{"@version":"1","event":{"hash":"8d7caf6fd21230d3c725cf6e0f0ea351960930244e42f397d78ee3d495d4247f"},"ecs":{"version":"1.6.0"},"message":"1765024840.280678\tCJza241hL4cUPlaca8\t172.30.1.12\t60505\t172.30.1.254\t53\tudp\t10578\t0.003461\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:42.264Z","host":{"name":"f6b540842a86"},"log":{"offset":580886,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500837 Key: Timestamp: 2025-12-06 12:40:44.372 Headers: empty

{"@version":"1","event":{"hash":"555ba9e72181ba80866a28d7ca8e8a44fd2ddc825ca28293f2eb3d4d2a691853"},"ecs":{"version":"1.6.0"},"message":"1765024841.290603\tCkLymw4FaI08OKUTb9\t172.30.1.12\t56604\t172.30.1.254\t53\tudp\t10579\t0.005474\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:43.265Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":581066},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500838 Key: Timestamp: 2025-12-06 12:40:44.372 Headers: empty

{"@version":"1","event":{"hash":"c53de73247afc42656e1fb09ea6039792e15a0f618441f3340185ec0bd8285c2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024781.757861\tCF2IVh27j3ILQd1SI2\tfe80::b2be:76ff:fec9:7610\t130\tff02::1\t131\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:43.368Z","host":{"name":"f6b540842a86"},"log":{"offset":645482,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500839 Key: Timestamp: 2025-12-06 12:40:44.372 Headers: empty

{"@version":"1","event":{"hash":"d36c5ba057e456617aa5b9288d441e970d1c8049b1b64181b985d9b613956f79"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024831.192275\tCb9iYn3MSoKQHaAxwi\t172.30.1.12\t39846\t172.30.1.254\t53\tudp\tdns\t0.000877\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:43.368Z","host":{"name":"f6b540842a86"},"log":{"offset":645229,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500840 Key: Timestamp: 2025-12-06 12:40:44.372 Headers: empty

{"@version":"1","event":{"hash":"8e355aa8d35430c167dfe079f2711afbaf607557cfdf14a3569c01f8d46ed0b1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024782.214482\tC5WCNQ7b9Vvi7quvd\tfe80::ca1f:66ff:fecb:6f36\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:40:43.368Z","host":{"name":"f6b540842a86"},"log":{"offset":645608,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500841 Key: Timestamp: 2025-12-06 12:54:47.172 Headers: empty

{"@version":"1","event":{"hash":"fffd62463f7253eef69459ee8e84e0ca83634fdc8c836f9aaf6ee09fcba4e1f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765025673.508476\tCo7iA63jTSN28H1WM5\t172.30.1.12\t60052\t172.30.1.254\t53\tudp\tdns\t0.003243\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:46.067Z","host":{"name":"f6b540842a86"},"log":{"offset":851099,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500842 Key: Timestamp: 2025-12-06 12:54:49.120 Headers: empty

{"@version":"1","event":{"hash":"e16d1b7f6d56b4e300a1fa65b87ad115b4d2c56d72da35bff8e98893a57898cd"},"ecs":{"version":"1.6.0"},"message":"1765025685.628903\tCRH2Ow4MWFUcDC9s0h\t172.30.1.12\t58915\t172.30.1.254\t53\tudp\t11405\t0.003313\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:48.016Z","host":{"name":"f6b540842a86"},"log":{"offset":782401,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500843 Key: Timestamp: 2025-12-06 12:54:49.120 Headers: empty

{"@version":"1","event":{"hash":"4b208512a6885a0e8391d8e26f90ce09e7d0325b05c5ccd3397f7a551f56f88c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765025676.538627\tCFbIAn1acVoZAtPRJf\t172.30.1.12\t51727\t172.30.1.254\t53\tudp\tdns\t0.003401\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:48.068Z","host":{"name":"f6b540842a86"},"log":{"offset":851747,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500844 Key: Timestamp: 2025-12-06 12:54:50.124 Headers: empty

{"@version":"1","event":{"hash":"4d11dfdfa8627619f92979308d1100d8a9b08542f9db7f978f52275c1ca465b9"},"ecs":{"version":"1.6.0"},"message":"1765025686.638598\tC9Yf221Em5gx32rzIb\t172.30.1.12\t52169\t172.30.1.254\t53\tudp\t11406\t0.003532\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:49.016Z","host":{"name":"f6b540842a86"},"log":{"offset":782581,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500845 Key: Timestamp: 2025-12-06 12:54:50.124 Headers: empty

{"@version":"1","event":{"hash":"aed5c091f07659d6b2fd76b7908b0a56e632589fad65caf52d1e0eaf0eff860a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765025677.548680\tCSeLif1pJq8aJZGSb\t172.30.1.12\t35829\t172.30.1.254\t53\tudp\tdns\t0.003399\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:49.068Z","host":{"name":"f6b540842a86"},"log":{"offset":851876,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500846 Key: Timestamp: 2025-12-06 12:54:51.125 Headers: empty

{"@version":"1","event":{"hash":"7781ccb40ab148c01b4ef2b64f14a16618142fde1bbfa7a13215a57eb99c72d1"},"ecs":{"version":"1.6.0"},"message":"1765025687.648621\tCwAgfp1uN5MihIUhPk\t172.30.1.12\t57429\t172.30.1.254\t53\tudp\t11407\t0.003410\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:50.016Z","host":{"name":"f6b540842a86"},"log":{"offset":782761,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500847 Key: Timestamp: 2025-12-06 12:54:51.125 Headers: empty

{"@version":"1","event":{"hash":"6a9e56f7f342cc85f924df30829f1b9a494f98c2518d2b9d76c3bd18970af0fb"},"ecs":{"version":"1.6.0"},"message":"1765025688.658683\tCYDUaruXVVLGMSRZi\t172.30.1.12\t59665\t172.30.1.254\t53\tudp\t11408\t0.003591\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:51.018Z","host":{"name":"f6b540842a86"},"log":{"offset":782941,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500848 Key: Timestamp: 2025-12-06 12:54:51.125 Headers: empty

{"@version":"1","event":{"hash":"46fdf9b8e34b0be5e3197434ede7a8a002ab850ef491e1084911fe75629484b1"},"ecs":{"version":"1.6.0"},"message":"1765025688.686840\tCrJVc14IvZA0oVs88e\t172.30.1.35\t51923\t172.30.1.254\t53\tudp\t10143\t0.005051\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2186.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:51.018Z","host":{"name":"f6b540842a86"},"log":{"offset":783120,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500849 Key: Timestamp: 2025-12-06 12:54:53.122 Headers: empty

{"@version":"1","event":{"hash":"f274d9146f34f17501890f22848d5ebd69acba5c46d3089e9d29eff3df23b8b2"},"ecs":{"version":"1.6.0"},"message":"1765025689.724702\tCGP5AJ1HvR0Rokjm7e\t172.30.1.12\t34884\t172.30.1.254\t53\tudp\t11409\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:52.018Z","host":{"name":"f6b540842a86"},"log":{"offset":783294,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1500850 Key: Timestamp: 2025-12-06 12:54:53.122 Headers: empty

{"@version":"1","event":{"hash":"85e3653f81cb177f9283222c5114fa89fb1e4c2871fe3d0dd40bedca34822dbe"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765025678.679061\tC1KBso1u8VNZiD5GSj\t172.30.1.35\t51590\t172.30.1.254\t53\tudp\tdns\t0.004608\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:54:52.069Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":852133},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network