Kafdrop

{"@version":"1","event":{"hash":"37649c4650d97638405106c1da3bf7363615b70cb70d4550857230538d3a3f99"},"ecs":{"version":"1.6.0"},"message":"1765023474.858314\tC6r0uH3lUQdFE9DXlh\t172.30.1.12\t50559\t8.8.8.8\t53\tudp\t9245\t0.026876\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t21.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:56.215Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":258046},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8d8f34d6d9f3f4b613c1411509d5b00c72914fad7fff8d85553cb1729af8d7fe"},"ecs":{"version":"1.6.0"},"message":"1765023473.797666\tCAG8os3qufxngOyiv2\t172.30.1.12\t53878\t8.8.8.8\t53\tudp\t9243\t0.026616\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t271.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:56.215Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":257699},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3c304b49d17016116d54f0b80a69bae1a302ec559cfb8913a63fb8466dd426e5"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023464.497890\tCQOh1y2Yh6AZ5UkLl4\t172.30.1.12\t42334\t8.8.8.8\t53\tudp\tdns\t0.026918\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:56.259Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":315716},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d8b924a72eddc2028076e7d674288e1a0f90d0dd11303e442671c172457f348f"},"ecs":{"version":"1.6.0"},"message":"1765023474.827832\tCOk0Bf2UxXvKKYtzDl\t172.30.1.12\t54171\t8.8.8.8\t53\tudp\t9244\t0.028947\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t21.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:56.215Z","host":{"name":"f6b540842a86"},"log":{"offset":257873,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b6916cf9faf0db94d0d6da5212cd0f3fb4a244b9bda2541e98861441fb6fbd07"},"ecs":{"version":"1.6.0"},"message":"1765023475.904170\tCrnstJ2Igyj0Ou2UA7\t172.30.1.12\t54371\t8.8.8.8\t53\tudp\t9246\t0.011082\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t20.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:57.222Z","host":{"name":"f6b540842a86"},"log":{"offset":258219,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"477cb78485aa4cb51b42cccda91174de20890b1c6cf3640ba635462e9ac7e48a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023465.527548\tCMmy3917zFRnnMVKM8\t172.30.1.12\t53033\t8.8.8.8\t53\tudp\tdns\t0.028999\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:57.260Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":315840},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5ca0af1ac6ab332870b60fa58fbea90125e84cc0c563931efed6d3d9646deadc"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023466.567566\tChMPvi31z5dGyQoucg\t172.30.1.12\t38618\t8.8.8.8\t53\tudp\tdns\t0.027493\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:58.260Z","host":{"name":"f6b540842a86"},"log":{"offset":315964,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9ba42acc54e458c1f3d1fd1bb5aaa04a2b4af0afe8fcc25658d8a6b990b67cd8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023467.597543\tCliPIY2teh6WlE2Hoc\t172.30.1.12\t46250\t8.8.8.8\t53\tudp\tdns\t0.028796\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:17:59.261Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":316088},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bac171bb05fc31aa4ccbe2eacc1638311180a7213a1dc7d46762e992e2e9517f"},"ecs":{"version":"1.6.0"},"message":"1765023476.917627\tCwmJuD22e8NZ0nj378\t172.30.1.12\t44051\t8.8.8.8\t53\tudp\t9247\t0.028082\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t268.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.223Z","host":{"name":"f6b540842a86"},"log":{"offset":258392,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8c2a4463e926cc98610760122b63131b75988019984564e42ed6ea78c5be1e8d"},"ecs":{"version":"1.6.0"},"message":"1765023477.947650\tCUZBMr4BzN5MIakys3\t172.30.1.12\t59855\t8.8.8.8\t53\tudp\t9248\t0.029604\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t267.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.223Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":258566},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a35d3a24d0d074f6c65712325daf9d96b0366e0b53c335bba46f3e43109dd4b2"},"ecs":{"version":"1.6.0"},"message":"1765023478.663667\tCfUOh8360EC80NYED9\t172.30.1.35\t51240\t172.30.1.254\t53\tudp\t31055\t0.004400\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t800.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.223Z","host":{"name":"f6b540842a86"},"log":{"offset":258740,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"48329c82eb866f35fd18db3cab38be3652732b3975d2a3919492f1fa286e5b1b"},"ecs":{"version":"1.6.0"},"message":"1765023478.987668\tCw1Gbt2Zi6UZFs72q4\t172.30.1.12\t45623\t8.8.8.8\t53\tudp\t9249\t0.027758\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t16.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.223Z","host":{"name":"f6b540842a86"},"log":{"offset":258913,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7c023203e11cf013c7c7fc79d53d6ad4e713b0b5c2cc8da3911c6b4700939ac0"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023458.665270\tCJBdo01cvL6CIEOJU1\t172.30.1.35\t55243\t172.30.1.254\t53\tudp\tdns\t2.012709\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.264Z","host":{"name":"f6b540842a86"},"log":{"offset":316336,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"561179c7c58b06022533f0b98d9f19d2b47c8489bd5e3c4ac269214fd03bb314"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023468.702755\tCjMIYF3YH6kX86qVql\t172.30.1.35\t55156\t8.8.8.8\t53\tudp\tdns\t0.027995\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.265Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":316467},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c2527ed191a378aeaa7b899860954dd2a2936642148f09f6ea786a7581c7d6f9"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023473.598909\tCMZ42e30Jp253aY9b\t172.30.1.2\t40038\t172.30.4.139\t1514\ttcp\t-\t2.999103\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.265Z","host":{"name":"f6b540842a86"},"log":{"offset":316593,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e047ba7df820d390ef6e830f978f61d7817d87b122e02fd5e57fc752e11ec45d"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023468.661301\tCgnMgj3Yibuv6yY6mj\t172.30.1.35\t55156\t172.30.1.254\t53\tudp\tdns\t0.260756\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.265Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":316717},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"52f7b72f9d5f4b606770133faa8d0b87fed9eba2ff5fa978ddb0bffc7711bed1"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023468.637611\tCUqXi33N4FgzG85wkd\t172.30.1.12\t34961\t8.8.8.8\t53\tudp\tdns\t0.027848\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:00.262Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":316212},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"eb1d9eacfec11af0bdc0d6f1b45036e4c2805aa6fa6fffecd3071df2e5aaa607"},"ecs":{"version":"1.6.0"},"message":"1765023480.017797\tCGLbO54u2rugKdjDOa\t172.30.1.12\t43384\t8.8.8.8\t53\tudp\t9250\t0.028425\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t15.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:01.223Z","host":{"name":"f6b540842a86"},"log":{"offset":259086,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0325b25bba57c7d4b964d9e1c8c2c117822c542547c23ee43133b8660d4a09f7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023469.667571\tCMPaej2kbBoElLUQW8\t172.30.1.12\t38568\t8.8.8.8\t53\tudp\tdns\t0.028249\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:01.265Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":316848},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f72779f038bdd0efd242c9713e6e7e2de2c67e1fa1116fec37ce8e4e83bc2c5e"},"ecs":{"version":"1.6.0"},"message":"1765023481.109372\tC4BS4EW8lk7c7q328\t172.30.1.12\t59184\t8.8.8.8\t53\tudp\t9251\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t263.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:02.225Z","host":{"name":"f6b540842a86"},"log":{"offset":259259,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ebdcc4e7a91827ce00372bba3ebb6b16bf1724391bd8a55277646113fa6d3e88"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023470.697614\tCoAiPS2FmUphxt2XKg\t172.30.1.12\t33395\t8.8.8.8\t53\tudp\tdns\t0.028278\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:02.265Z","host":{"name":"f6b540842a86"},"log":{"offset":316972,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0908c1d184dfae7bee6ae0083d5811ea383a3a0ef9f7d5b37ecf1adad98217c9"},"ecs":{"version":"1.6.0"},"message":"1765023482.097728\tCGBr3i1HEUhPekhlJd\t172.30.1.12\t39581\t8.8.8.8\t53\tudp\t9252\t0.028199\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t262.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:03.226Z","host":{"name":"f6b540842a86"},"log":{"offset":259425,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"524fc27aac4e0a1670952d6e5e284caf323466fd56b617a5922d5845d695ddf5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023476.598609\tCbh7OW3yyvXBcW2lHk\t172.30.1.2\t46316\t172.30.4.139\t1515\ttcp\t-\t2.999442\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:03.266Z","host":{"name":"f6b540842a86"},"log":{"offset":317213,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3da08667fd256fd474e4dcbe8bc4b4dcb4a4462f3e3eb72efc3a04e1eaa75203"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023471.737630\tCI8yKO2szl9t5uDUS8\t172.30.1.12\t46929\t8.8.8.8\t53\tudp\tdns\t0.027857\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:03.266Z","host":{"name":"f6b540842a86"},"log":{"offset":317338,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bb91a083cb1c8f8e8527418208a326211ab08077b478415a0fb0dc16cd1c059c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023476.264828\tCCGK4ZD2RoI2ensl4\t172.30.1.63\t48284\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:03.266Z","host":{"name":"f6b540842a86"},"log":{"offset":317096,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ff3a0a22518caf7c4a7451be215a75764e4a78c3671dad9a0f45bdd80f01c267"},"ecs":{"version":"1.6.0"},"message":"1765023483.137713\tCbasNP1iA2L343F5Kb\t172.30.1.12\t55415\t8.8.8.8\t53\tudp\t9253\t0.028773\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t186.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:04.226Z","host":{"name":"f6b540842a86"},"log":{"offset":259599,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6c0917d9d43439c6496245eb707063325b27a56a7b9bd528a07a9918c3c7d661"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023472.767639\tCxvvxv2jCRu7SMpvBl\t172.30.1.12\t36716\t8.8.8.8\t53\tudp\tdns\t0.027857\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:04.266Z","host":{"name":"f6b540842a86"},"log":{"offset":317462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"94a631b4f1d01529765c46c28055d3a827d739f7aea4e687cb915fc5eb50f4dc"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023473.797651\tCAG8os3qufxngOyiv2\t172.30.1.12\t53878\t8.8.8.8\t53\tudp\tdns\t0.026631\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:05.267Z","host":{"name":"f6b540842a86"},"log":{"offset":317586,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b5d253df98e194285be0b53bbf92c6d3f3f7ba2d6f1d8426952cc2d2b84adfe0"},"ecs":{"version":"1.6.0"},"message":"1765023483.667688\tCEmDWK15uMWoerg6gh\t172.30.1.35\t61353\t172.30.1.254\t53\tudp\t6292\t0.005241\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t795.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:05.228Z","host":{"name":"f6b540842a86"},"log":{"offset":259773,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6dda131c7615071f647671de941ee2e55d2804277986d26527294600f3bcb07e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023473.667185\tCBWGr82zaVQs8VRnJ\t172.30.1.35\t62736\t172.30.1.254\t53\tudp\tdns\t0.005168\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:05.267Z","host":{"name":"f6b540842a86"},"log":{"offset":317710,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e168c54294788651ff39f63ff39f8c7db14f88c94231f61d861ff2132d017644"},"ecs":{"version":"1.6.0"},"message":"1765023484.177757\tCP43WA2bGNonH7bL1c\t172.30.1.12\t45642\t8.8.8.8\t53\tudp\t9254\t0.026606\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t11.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:06.228Z","host":{"name":"f6b540842a86"},"log":{"offset":259945,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ab700564ffbd6c213d5131eaf21b50916423b127de5433e772943148264fc978"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023474.858314\tC6r0uH3lUQdFE9DXlh\t172.30.1.12\t50559\t8.8.8.8\t53\tudp\tdns\t0.026876\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:06.268Z","host":{"name":"f6b540842a86"},"log":{"offset":317964,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fa8f8f8e02ba2d1769fe26fbd4487ac9ce2b2eb196df4768a55f08064286497f"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023474.827832\tCOk0Bf2UxXvKKYtzDl\t172.30.1.12\t54171\t8.8.8.8\t53\tudp\tdns\t0.028947\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:06.268Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":317840},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"54e42b31e74e5e22d4c7395d5bd3d5409affdbe75034bbc7ed9360d8ae224464"},"ecs":{"version":"1.6.0"},"message":"1765023486.237812\tC0ThdK3YnOIYMT9Mvi\t172.30.1.12\t39396\t8.8.8.8\t53\tudp\t9256\t0.029646\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t9.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:07.235Z","host":{"name":"f6b540842a86"},"log":{"offset":260292,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"743da92a4bb1faf0172df34f62df88a52440596e9d759ade80f03487e7a97889"},"ecs":{"version":"1.6.0"},"message":"1765023485.210557\tCcjVPo4NFDn5QwKSZg\t172.30.1.12\t41880\t8.8.8.8\t53\tudp\t9255\t0.023970\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t273.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:07.235Z","host":{"name":"f6b540842a86"},"log":{"offset":260118,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bb0fdb0b152cd3a8693a1dd35af53831a4754d81fc8f1944dd582003afccfa56"},"ecs":{"version":"1.6.0"},"message":"1765023487.277833\tCqCTOS3iNeOcXIvpM8\t172.30.1.12\t42019\t8.8.8.8\t53\tudp\t9257\t0.028834\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t257.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:08.236Z","host":{"name":"f6b540842a86"},"log":{"offset":260464,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7c1b236269aa92e3d00bd95dc6e7d195b24f30de571a84806e2ec8bb91e54884"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023475.887658\tCrnstJ2Igyj0Ou2UA7\t172.30.1.12\t54371\t8.8.8.8\t53\tudp\tdns\t0.027594\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:09.269Z","host":{"name":"f6b540842a86"},"log":{"offset":318088,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3386d0ddfaffa4e2117e4fffa582357079508da8d073875fe4d24a836ce42249"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023477.947650\tCUZBMr4BzN5MIakys3\t172.30.1.12\t59855\t8.8.8.8\t53\tudp\tdns\t0.029604\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:09.269Z","host":{"name":"f6b540842a86"},"log":{"offset":318336,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5508d13043246802718421284566290f3a3b44fcda0172a57de4dd6730e15b80"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023476.917627\tCwmJuD22e8NZ0nj378\t172.30.1.12\t44051\t8.8.8.8\t53\tudp\tdns\t0.028082\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:09.269Z","host":{"name":"f6b540842a86"},"log":{"offset":318212,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f04e9302d6bdbee91e538ac14df5690e89b70d7e570d24e676653623060ff065"},"ecs":{"version":"1.6.0"},"message":"1765023488.322738\tC0svpn3LyautbQ75p4\t172.30.1.12\t52007\t8.8.8.8\t53\tudp\t9258\t0.029357\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t7.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:09.236Z","host":{"name":"f6b540842a86"},"log":{"offset":260638,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7a71f481a734fece6fd34d10a5274cb4a91774401934a4be0ef5c1696083331b"},"ecs":{"version":"1.6.0"},"message":"1765023488.669547\tCrKFGD3KOI5lLEeGN6\t172.30.1.35\t64872\t172.30.1.254\t53\tudp\t23822\t0.026082\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t155.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:10.236Z","host":{"name":"f6b540842a86"},"log":{"offset":260810,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"93f87ec4a03ea81a9c6b8776e7fcc9ef9b2d02650f4f4d8bae4f5915cc924533"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023478.987668\tCw1Gbt2Zi6UZFs72q4\t172.30.1.12\t45623\t8.8.8.8\t53\tudp\tdns\t0.027758\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:10.269Z","host":{"name":"f6b540842a86"},"log":{"offset":318591,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3d9cc0a44060b23586002a7375627424c06da9dfa873a1bf6064189ffa13d0a0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023478.663667\tCfUOh8360EC80NYED9\t172.30.1.35\t51240\t172.30.1.254\t53\tudp\tdns\t0.004400\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:10.269Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":318460},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"086cdfb21e7cd7fe20b0d050a98fd1190b7a11c25a6aa44b5322d98a3f7d995b"},"ecs":{"version":"1.6.0"},"message":"1765023489.357737\tCEUsp82XOa1QqEJYMk\t172.30.1.12\t35123\t8.8.8.8\t53\tudp\t9259\t0.028186\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t180.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:11.237Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":260983},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"77782c270495c32559d41ffd835e7c0dd8c45d62ff7c8624a831349be240834c"},"ecs":{"version":"1.6.0"},"message":"1765023490.387760\tCCBDU83vNdz7zSXyeb\t172.30.1.12\t56281\t8.8.8.8\t53\tudp\t9260\t0.028676\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t254.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:12.237Z","host":{"name":"f6b540842a86"},"log":{"offset":261157,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9ef412e49dc1573915bcde7e2649f1682136c44d5b8db457a6902d31c95d480b"},"ecs":{"version":"1.6.0"},"message":"1765023487.223786\tFXOsk33aKb1Cs3gM8d\t3\t330000005327CD597143EFB877000000000053\tCN=*.prod.do.dsp.mp.microsoft.com,OU=DSP,O=Microsoft,L=Redmond,ST=WA,C=US\tCN=Microsoft ECC Content Distribution Secure Server CA 2.1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\t1741120771.000000\t1772656771.000000\tid-ecPublicKey\tecdsa-with-SHA256\tecdsa\t256\t-\tprime256v1\t*.prod.do.dsp.mp.microsoft.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:12.287Z","host":{"name":"f6b540842a86"},"log":{"offset":20141,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"87c5bb429a73dedb2c87e2f93c78d768530fd2c7aa4722f7b741ad86529fa5b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023480.017797\tCGLbO54u2rugKdjDOa\t172.30.1.12\t43384\t8.8.8.8\t53\tudp\tdns\t0.028425\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:13.271Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":318715},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"58265a661f28750243c8595be7881c12c27dddb46acd3c8cb45916c10a864541"},"ecs":{"version":"1.6.0"},"message":"1765023491.427819\tCInlbg1NkyxXHaPinj\t172.30.1.12\t38077\t8.8.8.8\t53\tudp\t9261\t0.029431\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t253.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:13.244Z","host":{"name":"f6b540842a86"},"log":{"offset":261331,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"db63297ae3fa2a157d9eed7eb62a536598dc9b29da5f38e32d8d5429f3976855"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023481.057699\tC4BS4EW8lk7c7q328\t172.30.1.12\t59184\t8.8.8.8\t53\tudp\tdns\t0.028909\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:13.271Z","host":{"name":"f6b540842a86"},"log":{"offset":318839,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9913b34144c1ae91f7455fa74490719c8b1d057794945f0334e2dda49199da51"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023482.097728\tCGBr3i1HEUhPekhlJd\t172.30.1.12\t39581\t8.8.8.8\t53\tudp\tdns\t0.028199\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:14.271Z","host":{"name":"f6b540842a86"},"log":{"offset":318962,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"401d4363f3faae9fcf07caad75f6df342db54ab76fb3d38acd33ea3c27521c02"},"ecs":{"version":"1.6.0"},"message":"1765023492.469975\tCQm0o83QSjm0VUTr3\t172.30.1.12\t42520\t8.8.8.8\t53\tudp\t9262\t0.024438\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t177.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:14.244Z","host":{"name":"f6b540842a86"},"log":{"offset":261505,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9ac68521696f40239e4bc208ee0cfa36eeb5d932871279b9cb58d1e595911c19"},"ecs":{"version":"1.6.0"},"message":"1765023493.010180\tCJ6bWbdlXinlnay87\t172.30.1.3\t52895\t8.8.8.8\t53\tudp\t7961\t0.035058\tlitedev.sgp.hik-connect.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tlitedev.sgp.ezvizlife.com,alisgp.litedev.ezvizlife.com,8.214.27.19\t300.000000,60.000000,300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:14.245Z","host":{"name":"f6b540842a86"},"log":{"offset":261678,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"01c32db43be6f1669132ee53d5a8bfdb8ad9de764757877f2ab7ebebe4819f10"},"ecs":{"version":"1.6.0"},"message":"1765023493.658806\tC8DMQm110spkFyGld4\t172.30.1.35\t58430\t172.30.1.254\t53\tudp\t62737\t0.004556\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t785.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:15.246Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":261926},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1f8b390dcc6062e7f16fff5195872d2bcea6880989d72d7e30b116e06929d85a"},"ecs":{"version":"1.6.0"},"message":"1765023493.498373\tCEL4tl1TdQhnWBg7l\t172.30.1.12\t44988\t8.8.8.8\t53\tudp\t9263\t0.102381\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t2.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:15.246Z","host":{"name":"f6b540842a86"},"log":{"offset":262099,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a65aa6ba0240160f886fb90d27d7954e6c102a6924ffac91365c72e93c9b695b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023483.137713\tCbasNP1iA2L343F5Kb\t172.30.1.12\t55415\t8.8.8.8\t53\tudp\tdns\t0.028773\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:15.272Z","host":{"name":"f6b540842a86"},"log":{"offset":319086,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"090cb8dc53b63db18eb6f79be9afc530a94413084e5582066a3c1aa3659a6cf1"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023484.177757\tCP43WA2bGNonH7bL1c\t172.30.1.12\t45642\t8.8.8.8\t53\tudp\tdns\t0.026606\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:15.272Z","host":{"name":"f6b540842a86"},"log":{"offset":319210,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8660ac099c921d4d793642c81f5da7fc5d420457d24e6c63e7d9c2686d1643ec"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023483.667688\tCEmDWK15uMWoerg6gh\t172.30.1.35\t61353\t172.30.1.254\t53\tudp\tdns\t0.005241\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:15.272Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":319334},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"77edfb412304c8ae418a8241067e0b99c9699ef92bcdd70a79d8212ae37db972"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023489.599138\tClG3gU2Np17JrLrN6b\t172.30.1.2\t40042\t172.30.4.139\t1514\ttcp\t-\t2.998883\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:16.272Z","host":{"name":"f6b540842a86"},"log":{"offset":319465,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"345c93617b5d522576b2de420bb15e383379449712d839f289d11b33b8189276"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023489.885794\tCfwsMo3T39D82OnD2j\t172.30.2.16\t62028\t172.30.1.35\t7680\ttcp\t-\t0.001960\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:16.272Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":319590},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0ed32dda15b523de7899d9e23595c66827f405f777caab331997ce8118ca510c"},"ecs":{"version":"1.6.0"},"message":"1765023495.567807\tCvX35a2pHccPTeDKp9\t172.30.1.12\t60152\t8.8.8.8\t53\tudp\t9265\t0.027063\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t249.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:16.246Z","host":{"name":"f6b540842a86"},"log":{"offset":262442,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a222fe2f7eeb36088067b9b510ef91a93777b3d4f23ed355cf5ecbd2491e8e05"},"ecs":{"version":"1.6.0"},"message":"1765023494.537852\tCoch2Z16O72tRmDam3\t172.30.1.12\t58999\t8.8.8.8\t53\tudp\t9264\t0.027520\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t1.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:16.246Z","host":{"name":"f6b540842a86"},"log":{"offset":262270,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"db6633a575d78f1aa630be1c922b2a1b38817568d6719ecf9fdb44fd9031b49e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023485.207764\tCcjVPo4NFDn5QwKSZg\t172.30.1.12\t41880\t8.8.8.8\t53\tudp\tdns\t0.026763\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:16.272Z","host":{"name":"f6b540842a86"},"log":{"offset":319724,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4d6c1e966f05a7c4857b1e3e9b7a3134eaae8104ae7508e2817d9099d171663e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023486.237812\tC0ThdK3YnOIYMT9Mvi\t172.30.1.12\t39396\t8.8.8.8\t53\tudp\tdns\t0.029646\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:17.272Z","host":{"name":"f6b540842a86"},"log":{"offset":319848,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b4f2cc1791602da97be0ffb9372d945ec0005815ea34c6798868360e290d935b"},"ecs":{"version":"1.6.0"},"message":"1765023487.033218\tCblKuB1vbFjxvncv69\t172.30.1.35\t56035\t72.154.7.98\t443\tTLSv12\tTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\tsecp384r1\tarray805.prod.do.dsp.mp.microsoft.com\tF\t-\th2\tT\tFXOsk33aKb1Cs3gM8d,FsbuaU32v2mOOE9mQh\t(empty)\tCN=*.prod.do.dsp.mp.microsoft.com,OU=DSP,O=Microsoft,L=Redmond,ST=WA,C=US\tCN=Microsoft ECC Content Distribution Secure Server CA 2.1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\t-\t-\tunable to get local issuer certificate\t28a2c9bd18a11de089ef85a160da29e4\ta02d7ceb8c8cbb4da2e6007f5a1c91e4","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:17.271Z","host":{"name":"f6b540842a86"},"log":{"offset":20143,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a3c9845b3557d4947f6c196e0b52eb1ae26da9e3f0dcf002a3af64aa0a00d0f2"},"ecs":{"version":"1.6.0"},"message":"1765023496.597864\tCeQvwWft5wwT5m0J8\t172.30.1.12\t37813\t8.8.8.8\t53\tudp\t9266\t0.028885\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t299.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:19.247Z","host":{"name":"f6b540842a86"},"log":{"offset":262616,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"34dbd61ffc1b30581410ba9378d1b64f728707054e21cbc96982a3b6888e71cc"},"ecs":{"version":"1.6.0"},"message":"1765023497.652950\tCXKBD78N3e0NHfGrb\t172.30.1.12\t55660\t8.8.8.8\t53\tudp\t9267\t0.014226\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t247.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:19.247Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":262789},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0eefb934a1b184fb084b4a8813b49ece5ab3dd2a4fc4b930fcfe771a4afa64de"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023487.277833\tCqCTOS3iNeOcXIvpM8\t172.30.1.12\t42019\t8.8.8.8\t53\tudp\tdns\t0.028834\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:18.273Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":319972},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"88ec8a22f21aa355a5f20f3c8f3399647086d8e076f826589fc27307f809a46e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023493.045569\tCz7yysfVuacUywflj\t172.30.1.3\t41408\t8.214.27.19\t8666\ttcp\t-\t0.261008\t138\t189\tSF\tT\tF\t0\tShADadFf\t9\t614\t8\t613\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:19.275Z","host":{"name":"f6b540842a86"},"log":{"offset":320096,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e40ac4324ad137e6487586ab9f111b02205c6f40fe8a8b3061e3e67d0a818f6e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023488.322738\tC0svpn3LyautbQ75p4\t172.30.1.12\t52007\t8.8.8.8\t53\tudp\tdns\t0.029357\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:19.285Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":320232},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"72d5827bca8865131dc0dcd9ce0dcf38968483aacb16ea83f3d7f46dc0db07f5"},"ecs":{"version":"1.6.0"},"message":"1765023498.661620\tCs3Rxe16fxxK80zpGa\t172.30.1.35\t60188\t172.30.1.254\t53\tudp\t39431\t0.005422\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t780.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:20.247Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":262962},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fcc2432ae2c2c4bd024a4785b78f32c557ad26e514708aded27b1f16933ed4d5"},"ecs":{"version":"1.6.0"},"message":"1765023498.680807\tCesmfM3fnt5uAvHLJi\t172.30.1.12\t59899\t8.8.8.8\t53\tudp\t9268\t0.025973\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t260.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:21.247Z","host":{"name":"f6b540842a86"},"log":{"offset":263135,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0e0be98cb47e2559b903bab7135c18d87a6a20a1f3a8e37275d4101ba4e0e28f"},"ecs":{"version":"1.6.0"},"message":"1765023499.718007\tC0eIPQ3NYUblMHLBue\t172.30.1.12\t34990\t8.8.8.8\t53\tudp\t9269\t0.027397\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t112.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:21.247Z","host":{"name":"f6b540842a86"},"log":{"offset":263309,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fd1038833b7becf18a2e83893dcaa2ff72c66dd3c76b94392f7539080584f7b1"},"ecs":{"version":"1.6.0"},"message":"1765023500.747818\tCMH3h54yaE4tkSArQa\t172.30.1.12\t58420\t8.8.8.8\t53\tudp\t9270\t0.027232\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t295.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.248Z","host":{"name":"f6b540842a86"},"log":{"offset":263483,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3b975707ae2d7026d8b91ca27751160f97ea20bcb454d278d57e9b4d9f25f2a1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023489.357737\tCEUsp82XOa1QqEJYMk\t172.30.1.12\t35123\t8.8.8.8\t53\tudp\tdns\t0.028186\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":320487,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"08f02aa237d001e569be450e2b2e2535c5080abb5da5f668378355b7acc5e46c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023488.669547\tCrKFGD3KOI5lLEeGN6\t172.30.1.35\t64872\t172.30.1.254\t53\tudp\tdns\t0.026082\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":320356},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1cd7ccfbdcd4c66490e31132a3109e3961b88d1b61e8757c5f4653322129169b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023490.387760\tCCBDU83vNdz7zSXyeb\t172.30.1.12\t56281\t8.8.8.8\t53\tudp\tdns\t0.028676\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":320611,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ba4f518c6f7aff7713449c33b680fc75c18417ff16c25c459c4e15ac9b956fee"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023440.765855\tCDBxDG3HLuOKpxzPf1\t172.30.1.190\t68\t172.30.1.254\t67\tudp\tdhcp\t-\t-\t-\tSHR\tT\tT\t0\t^d\t0\t0\t1\t328\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":320735,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ee8b5e293414c31acef5b06cc0c13e5921b06aedbf1a13d72949c34a144bed4d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023435.519027\tC3hhhk4WHSyGvxnAga\t172.30.1.35\t56029\t119.46.207.179\t443\ttcp\tssl\t60.119485\t524\t8545\tSF\tT\tF\t0\tShADdaFfR\t10\t936\t13\t9077\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":320855,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"26126f9f579eeb313edeb58ac31c1757bdbad774cd0ce0fb2ce89e77752cc1f7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023435.464338\tCmNxrp1hgcoPZwmbha\t172.30.1.35\t56028\t23.199.141.93\t80\ttcp\thttp\t60.184771\t218\t262\tSF\tT\tF\t0\tShADadFf\t6\t470\t4\t434\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":321003,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"53feddccde085095b1f02099f476c9b0c837991824f6e9e36678840323c7a232"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023440.765121\tCU8hKNasR2o48MJ88\t0.0.0.0\t68\t255.255.255.255\t67\tudp\tdhcp\t-\t-\t-\tS0\tF\tF\t0\tD\t1\t336\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:22.286Z","host":{"name":"f6b540842a86"},"log":{"offset":321145,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"af4c68a41f68caee70e1f74d1c25b6a08c4f4b8cb65719fdce4a359d13f76679"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023491.427819\tCInlbg1NkyxXHaPinj\t172.30.1.12\t38077\t8.8.8.8\t53\tudp\tdns\t0.029431\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:23.287Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":321260},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"61d7d185ef5f9ce24b53b859087079943f46cdb98df0be7c50a47834be9a3c21"},"ecs":{"version":"1.6.0"},"message":"1765023501.777895\tCug2b8OGMFjL6Sijb\t172.30.1.12\t44914\t8.8.8.8\t53\tudp\t9271\t0.028949\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t243.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.248Z","host":{"name":"f6b540842a86"},"log":{"offset":263657,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7a3b101e10ac9ad7e826f3ae959fe40f7555b3e6a9c6bfbc00bcfc7f3f02dde7"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765023492.467812\tCQm0o83QSjm0VUTr3\t172.30.1.12\t42520\t8.8.8.8\t53\tudp\tdns\t0.026601\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:24.288Z","host":{"name":"f6b540842a86"},"log":{"offset":321384,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"847f5c2a640f37f5ed3b5c8acd9fcf7856b4425f2c1765db171388e7fdbf1a40"},"ecs":{"version":"1.6.0"},"message":"1765023502.817987\tCvSw973RBl7J7bRbMg\t172.30.1.12\t42878\t8.8.8.8\t53\tudp\t9272\t0.030277\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t242.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.248Z","host":{"name":"f6b540842a86"},"log":{"offset":263830,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"60623da2b489498cf0e4975af3d83668fb3ec271f7b7c5b361d32e3d50cb1b12"},"ecs":{"version":"1.6.0"},"message":"1765023503.658945\tCLl2iE17beH7WAXmef\t172.30.1.35\t50464\t172.30.1.254\t53\tudp\t30052\t0.002411\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t775.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.248Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":264004},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0c497b48e8bdb7e965f0f782e5e44b406cc8512c5a8a82d7b29cb4b0cc808a74"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023493.010180\tCJ6bWbdlXinlnay87\t172.30.1.3\t52895\t8.8.8.8\t53\tudp\tdns\t0.035058\t45\t126\tSF\tT\tF\t0\tDd\t1\t73\t1\t154\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.288Z","host":{"name":"f6b540842a86"},"log":{"offset":321507,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3ae9a83502a1f6fa660473a7e028ecbeb8e83a7217e75e3b942bad3a3c9288e7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765023493.498373\tCEL4tl1TdQhnWBg7l\t172.30.1.12\t44988\t8.8.8.8\t53\tudp\tdns\t0.028866\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.288Z","host":{"name":"f6b540842a86"},"log":{"offset":321631,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c9ffdd56810c8807507af074fb01a229ae32743e1329858108c4b2b96b2bab86"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765023493.658806\tC8DMQm110spkFyGld4\t172.30.1.35\t58430\t172.30.1.254\t53\tudp\tdns\t0.004556\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.288Z","host":{"name":"f6b540842a86"},"log":{"offset":321754,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ea8e3243b2ec68ebe768f75dc00aca396ed6aec95fadcf1a859ef40220d902b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765023443.868948\tC73C3h2TOO436BKY7d\t172.30.1.132\t42940\t216.239.35.12\t123\tudp\tntp\t0.028254\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:25.288Z","host":{"name":"f6b540842a86"},"log":{"offset":321885,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"65caf9673dadccc6594994f18a4adcae15c2cddfc66757d689b21f170a1958ff"},"ecs":{"version":"1.6.0"},"message":"1765023503.907689\tCFF2t64cTf9ERCLwdk\t172.30.1.12\t51287\t8.8.8.8\t53\tudp\t9273\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t255.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:26.249Z","host":{"name":"f6b540842a86"},"log":{"offset":264177,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4de9df83ccad6c8c9908caf38c2d03c2ea118b96b947a6e7f0d9febe659d8a5a"},"ecs":{"version":"1.6.0"},"message":"1765023504.898040\tCIzTqX27wuh5ryPMW2\t172.30.1.12\t44774\t8.8.8.8\t53\tudp\t9274\t0.028277\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:18:26.249Z","host":{"name":"f6b540842a86"},"log":{"offset":264344,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8004bd0f9ad663621bfb83bbb00d3115b90a141c903b62349055698cbd40f160"},"ecs":{"version":"1.6.0"},"message":"1765024184.284346\tCa30y418mFy3YNvy4k\t172.30.1.12\t39752\t8.8.8.8\t53\tudp\t9937\t0.027942\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t160.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.730Z","host":{"name":"f6b540842a86"},"log":{"offset":425232,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0f0761ce5d18f009776d7defea054bc33126e37eb37e5cd827563d90f89a6a3d"},"ecs":{"version":"1.6.0"},"message":"1765024183.746153\tC9V7Gi4AwRMR6VA99a\t172.30.1.35\t63558\t8.8.8.8\t53\tudp\t4428\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t46.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.730Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":425406},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3e9359483721ebd6da6200cc358170c648a224afdb6eed5d17367abe1c3c4280"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024172.864458\tCv6JxP2gMRgaFjNwN5\t172.30.1.12\t37652\t8.8.8.8\t53\tudp\tdns\t0.028165\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:44.862Z","host":{"name":"f6b540842a86"},"log":{"offset":484843,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b7de9473f32b02d242d55416e1ccb2bae4e3d7ee4212e884d515d3e152165dcc"},"ecs":{"version":"1.6.0"},"message":"1765024183.967591\tCwirAf3iazoblKpr2l\t172.30.1.132\t50565\t8.8.8.8\t53\tudp\t44416\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.730Z","host":{"name":"f6b540842a86"},"log":{"offset":425080,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b2e624b60d73359c6c8b7eff0a757f4e0185080198fa579f324f8ec00a605e37"},"ecs":{"version":"1.6.0"},"message":"1765024183.670503\tCuEmSm3W3Lh8yRRr29\t172.30.1.35\t63558\t172.30.1.254\t53\tudp\t4428\t0.682248\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t429.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.730Z","host":{"name":"f6b540842a86"},"log":{"offset":425565,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"925f784b806cc1d1b63f8838f553a3d7bfc84ca9ecb9aaa50680780aa0132592"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765024173.904256\tCyNwWm18cCBPTnNixd\t172.30.1.12\t51559\t8.8.8.8\t53\tudp\tdns\t0.029337\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.862Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":484967},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"979fe01e07378de2124ce88779d7c1ed427e44d8d276c355f53857993a355968"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765024173.669566\tCdAYPI2g43Ak31SI8i\t172.30.1.35\t64527\t172.30.1.254\t53\tudp\tdns\t0.008411\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.862Z","host":{"name":"f6b540842a86"},"log":{"offset":485091,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e8021ea5ee457703a71f92b405258de59baf10334dbcea0eac9c36588f1266b3"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765024163.665812\tCd3Pk51ntWbuIkl6mj\t172.30.1.35\t65080\t172.30.1.254\t53\tudp\tdns\t2.022419\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.862Z","host":{"name":"f6b540842a86"},"log":{"offset":485222,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a65be11731a0898f66d136f8ce724b15947d8bc9104135b9f58d97b0cb41ceb3"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765024174.944293\tC7Sr8ZXPKaHALHZSk\t172.30.1.12\t59239\t8.8.8.8\t53\tudp\tdns\t0.030219\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T12:29:45.862Z","host":{"name":"f6b540842a86"},"log":{"offset":485353,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}