Kafdrop

{"@version":"1","event":{"hash":"289e95c587dc3bd30cc1d7432d8ad80c6f1393be234d7ada0d3522ffba057a3a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028692.427192\tCtBTOsyieQm1mRqQ2\t172.30.1.12\t43383\t172.30.1.254\t53\tudp\tdns\t0.002803\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:04.572Z","host":{"name":"f6b540842a86"},"log":{"offset":692618,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6d17f718f41e236cdbe2048542dcb9c472f2be61f26633cd63b9b4666e301cad"},"ecs":{"version":"1.6.0"},"message":"1765028702.527150\tChefEs2015rrwK9oGd\t172.30.1.12\t46053\t172.30.1.254\t53\tudp\t14360\t0.005730\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:04.372Z","host":{"name":"f6b540842a86"},"log":{"offset":713185,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"93324ca53108b9ddabe31b1b5777a33f69940f7612a8dddb577460f4ca60d168"},"ecs":{"version":"1.6.0"},"message":"1765028703.753664\tCBvvCF1AvqU9XxjDKc\t172.30.1.35\t57595\t8.8.8.8\t53\tudp\t17964\t0.028149\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t524.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:05.373Z","host":{"name":"f6b540842a86"},"log":{"offset":713365,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"01ce7f4f50d6c46295c3a52f5c494ae2290775f3a5c6d78ee67bf4f355544c7c"},"ecs":{"version":"1.6.0"},"message":"1765028703.537162\tCpae2P1A0SJ0zkKZu9\t172.30.1.12\t58768\t172.30.1.254\t53\tudp\t14361\t0.002979\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:05.373Z","host":{"name":"f6b540842a86"},"log":{"offset":713533,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"28492ef7d9a2402a0f07febc7d9480bd941acc57bcb027ee339cb1bed438a74e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028693.712581\tCCOaEc26mxqQUKgm9d\t172.30.1.35\t59194\t172.30.1.254\t53\tudp\tdns\t0.025258\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:05.573Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":692875},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0a374938b09014dc03d1d4578cf41571714d60f64d3a9ca5dcc2e85c72cafbb5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028693.437130\tCfYWYR1NN5bsWsi5uk\t172.30.1.12\t44528\t172.30.1.254\t53\tudp\tdns\t0.002903\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:05.573Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":692746},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6a6901b23cb456a095910d9e731065c51a5d70e1083491f636d85af5814235d9"},"ecs":{"version":"1.6.0"},"message":"1765028703.774122\tC0a6pq1q1wjCyBk3cg\t172.30.1.35\t57595\t172.30.1.254\t53\tudp\t17964\t0.991600\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t62.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:06.377Z","host":{"name":"f6b540842a86"},"log":{"offset":713893,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"76a2ffc67fe1996f6f9eb34df7389fd36d5f7e4ec54c1162a3e6cddcb2c8fbd8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028694.447122\tCzQSbM1sr3dSi6aE8b\t172.30.1.12\t49448\t172.30.1.254\t53\tudp\tdns\t0.002833\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:06.573Z","host":{"name":"f6b540842a86"},"log":{"offset":693006,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"12508886e31e2b42d522a81266d170565e71d3453e68121a156db9df674b852f"},"ecs":{"version":"1.6.0"},"message":"1765028704.547582\tCgVZqB4qwUcKc3ZH6f\t172.30.1.12\t34590\t172.30.1.254\t53\tudp\t14362\t0.003743\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:06.374Z","host":{"name":"f6b540842a86"},"log":{"offset":713713,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6060248421d4bf970af3a8e35b7b6894da6858f49b9d92fe5cd1b285831bae9b"},"ecs":{"version":"1.6.0"},"message":"1765028705.557244\tCQIaCG2p60XTGoMcg7\t172.30.1.12\t59016\t172.30.1.254\t53\tudp\t14363\t0.002968\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:07.378Z","host":{"name":"f6b540842a86"},"log":{"offset":714065,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ac77ef3b093253809a43a5aa17c2d176ae3b47f2fb77353ac20491b05e21b868"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028633.880081\tCcU2BZpyRHRNivgG3\t172.30.1.35\t56176\t52.123.128.14\t443\ttcp\tssl\t66.807452\t1098\t7171\tRSTR\tT\tF\t0\tShADadr\t7\t1390\t12\t7663\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:07.574Z","host":{"name":"f6b540842a86"},"log":{"offset":693264,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"17f1bb8677e0c0e67feef8c68808ddb39f2ed8726f2aa2033d2799707637aacf"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028695.457264\tCUyPnt4pfUTNJevm1k\t172.30.1.12\t58606\t172.30.1.254\t53\tudp\tdns\t0.002888\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:07.574Z","host":{"name":"f6b540842a86"},"log":{"offset":693135,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"df0f1eafdf3317c76ce503d84671942a4746ec1a0a608ef8ad7e920eaf5e79b3"},"ecs":{"version":"1.6.0"},"message":"1765028706.567338\tC4j7da2pJNDzqKO1Kd\t172.30.1.12\t33899\t172.30.1.254\t53\tudp\t14364\t0.003208\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:08.380Z","host":{"name":"f6b540842a86"},"log":{"offset":714245,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"989b3877b6c68da2850fcf41222c05b5a1c5e2f46fd088649d4c3ccf9d1408df"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028696.467096\tC5PFqa4WfMEEdtd8ga\t172.30.1.12\t48895\t172.30.1.254\t53\tudp\tdns\t0.003146\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:08.574Z","host":{"name":"f6b540842a86"},"log":{"offset":693411,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"279640ea63d2f89b75e9c3b3cd293585d34b9bda2229d8e9bb4534e71bc4bd1c"},"ecs":{"version":"1.6.0"},"message":"1765028707.577205\tCN9ZN42XF1GU6kTJC4\t172.30.1.12\t53266\t172.30.1.254\t53\tudp\t14365\t0.003464\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:09.385Z","host":{"name":"f6b540842a86"},"log":{"offset":714425,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e2efcaf8912b677511a41f1b05bb055dd6756a9406bae88c656f456e75b9a400"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028697.478001\tCShqz94yKfjPT4TLG8\t172.30.1.12\t40294\t172.30.1.254\t53\tudp\tdns\t0.002425\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:09.574Z","host":{"name":"f6b540842a86"},"log":{"offset":693540,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cf5873eb2e2481e6924ab6db725630269c14b8ce80328aaca6d64a3bbd464a85"},"ecs":{"version":"1.6.0"},"message":"1765028708.424722\tCkMWte2zQjlCurM3\t202.46.62.25\t48702\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tF29k95209tq1wIjful,FBebmD12EH9Rxn0rW2\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:09.715Z","host":{"name":"f6b540842a86"},"log":{"offset":37705,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c1fd61dce65850056125aa2e9062b0ee116d13d935f83427ff337e70c656c16a"},"ecs":{"version":"1.6.0"},"message":"1765028708.587811\tC2ASxT18kxQMrMnyHg\t172.30.1.12\t55803\t172.30.1.254\t53\tudp\t14366\t0.002931\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:10.386Z","host":{"name":"f6b540842a86"},"log":{"offset":714605,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d90da5f453a17517cdac5268f09d3757a614d0add37bf0ae02521d6c1407d27b"},"ecs":{"version":"1.6.0"},"message":"1765028706.283167\tCXzG5p4LTciP8Vynbj\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\t0\t2.025663\tpower-consumption-ssc.local\t32769\tqclass-32769\t255\t*\t0\tNOERROR\tT\tF\tF\tF\t0\t_esphomelib._tcp.local,power-consumption-ssc._esphomelib._tcp.local,power-consumption-ssc.local,TXT 51 api_encryption=Noise_NNpsk0_25519_ChaChaPoly_SHA256 TXT 12 network=wifi TXT 24 board=ttgo-t7-v14-mini32 TXT 14 platform=ESP32 TXT 16 mac=0cb8151ae720 TXT 16 version=2023.6.5 TXT 35 friendly_name=Power-Consumption-SSC,172.30.1.65\t4500.000000,4500.000000,120.000000,4500.000000,120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:10.386Z","host":{"name":"f6b540842a86"},"log":{"offset":714785,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6f2bce851d361c42b397579f4e05f55fbe0b16716b4188e4408be117da6db6ad"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028698.487263\tC2Q8Qk16XnnRjdrQNa\t172.30.1.12\t51768\t172.30.1.254\t53\tudp\tdns\t0.003666\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:10.575Z","host":{"name":"f6b540842a86"},"log":{"offset":693669,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"44d03da2b435e8290c39bd1a0d4cb224e6e499db548c76013ae6254b4d3e6b30"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028698.745331\tC7Wj2c4wBySPxu73el\t172.30.1.35\t58231\t8.8.8.8\t53\tudp\tdns\t0.029767\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:10.575Z","host":{"name":"f6b540842a86"},"log":{"offset":693798,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6b8b12dcb168ab2b3d0420688392cf49aea7035b4e3b6e62822ab9c14371aea9"},"ecs":{"version":"1.6.0"},"message":"1765028708.800782\tCsbDMV3GGI7TrvuFuc\t172.30.1.35\t58444\t172.30.1.254\t53\tudp\t52583\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t58.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:11.386Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":715336},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"047a762a0fe3b90fe99fe43c92fb2e6616137fcb9fc7cb047e27f16e939c73ee"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028699.497140\tCWYPKv3IcKDsxbfqr9\t172.30.1.12\t56056\t172.30.1.254\t53\tudp\tdns\t0.003590\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:11.575Z","host":{"name":"f6b540842a86"},"log":{"offset":693924,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f34e659d48d11cab2e36bead9d8b20f8a729ee6bacca1aa451446acf59fce866"},"ecs":{"version":"1.6.0"},"message":"1765028709.597405\tC7GBKF3Y3uGYQZxt6i\t172.30.1.12\t56780\t172.30.1.254\t53\tudp\t14367\t0.003267\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:11.386Z","host":{"name":"f6b540842a86"},"log":{"offset":715501,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e6e06c49ded1987d5904795d449a62245da7f2483c0e42d9f77a62f41e9d977a"},"ecs":{"version":"1.6.0"},"message":"1765028710.607586\tCT186o4UCc7NxfLfv5\t172.30.1.12\t50377\t172.30.1.254\t53\tudp\t14368\t0.002325\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:12.387Z","host":{"name":"f6b540842a86"},"log":{"offset":715681,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"be0c73977ab5423bafed359da50934df564783d6dada77718bc655a83178bbeb"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028700.507200\tCMIbA02Tbi63ZvKSO8\t172.30.1.12\t40646\t172.30.1.254\t53\tudp\tdns\t0.004146\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:12.575Z","host":{"name":"f6b540842a86"},"log":{"offset":694053,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"58d9a149a96944ab350cbc934d41f6332fe59e6dcbb93d4495e91e2f692acf94"},"ecs":{"version":"1.6.0"},"message":"1765028711.617286\tCVj0e91MEdUmC0wi8g\t172.30.1.12\t48131\t172.30.1.254\t53\tudp\t14369\t0.002635\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:13.387Z","host":{"name":"f6b540842a86"},"log":{"offset":715861,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"07587ae290025158e932be9f9dbd79d652cbc73217de643d77a1179b6b3a4b48"},"ecs":{"version":"1.6.0"},"message":"1765028712.627371\tCAJTv947pc92hZdjJb\t172.30.1.12\t43984\t172.30.1.254\t53\tudp\t14370\t0.002906\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:14.387Z","host":{"name":"f6b540842a86"},"log":{"offset":716041,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3e8628a903a359c8cf5b2c9ec20975c6f8304b0e7d5ed799108c4f2c8daece3e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028706.070980\tC0NGHi1n9cvxr0uyb4\t202.46.62.68\t11812\t172.30.1.2\t80\ttcp\thttp\t1.221668\t312\t512\tSF\tF\tT\t0\tShADadfF\t7\t692\t6\t840\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:13.576Z","host":{"name":"f6b540842a86"},"log":{"offset":694182,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f6859ba2820e22f95e773224b51cfa3402aa40750192e1de2ca90561efc6a60b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028701.517134\tCHmnUj4gzLBgHtidZe\t172.30.1.12\t38388\t172.30.1.254\t53\tudp\tdns\t0.002993\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:13.576Z","host":{"name":"f6b540842a86"},"log":{"offset":694321,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"da2a701c6660c6573614dbb0eb449c4c16b8d3cc9f7e7a90738f215b99c6c88b"},"ecs":{"version":"1.6.0"},"message":"1765028713.637287\tCVwrri1NEkDkEz1b08\t172.30.1.12\t56153\t172.30.1.254\t53\tudp\t14371\t0.002893\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.388Z","host":{"name":"f6b540842a86"},"log":{"offset":716221,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"475bc8aca19f10f502a3b60f1d1f0e1370d27f153c1bce47d21996d0c43d7aab"},"ecs":{"version":"1.6.0"},"message":"1765028713.708068\tCx5t3c13ELOFNnLX75\t172.30.1.35\t54377\t172.30.1.254\t53\tudp\t8681\t0.004678\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t53.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.388Z","host":{"name":"f6b540842a86"},"log":{"offset":716401,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"841bdb614459b35ea40fa09b4be661c20c6669a1a48587d44f1edbd651e9ba88"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028702.527150\tChefEs2015rrwK9oGd\t172.30.1.12\t46053\t172.30.1.254\t53\tudp\tdns\t0.005730\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:14.577Z","host":{"name":"f6b540842a86"},"log":{"offset":694450,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"293b56266ad6e81cfe18d77050e80f06e5b3efe8d0fdb12ffa5518a151141cbc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028703.753664\tCBvvCF1AvqU9XxjDKc\t172.30.1.35\t57595\t8.8.8.8\t53\tudp\tdns\t0.028149\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.579Z","host":{"name":"f6b540842a86"},"log":{"offset":694579,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"babc868e6b3b9113350fcfea7d56a54223943783c8d7cf33ccd1fe6a1f2b86a7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028703.714604\tC0a6pq1q1wjCyBk3cg\t172.30.1.35\t57595\t172.30.1.254\t53\tudp\tdns\t1.051118\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.585Z","host":{"name":"f6b540842a86"},"log":{"offset":694705,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"41d2a46ebbbc9fdab8f4f89cbf5f1faeb8468b0a2bdb1404d4b574db4a6e19f5"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028703.537162\tCpae2P1A0SJ0zkKZu9\t172.30.1.12\t58768\t172.30.1.254\t53\tudp\tdns\t0.002979\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.585Z","host":{"name":"f6b540842a86"},"log":{"offset":694836,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e6e45569fd24c718b031465b021dc7d89a3dea1a7e6c1a5d3cef1fe3db2723d4"},"ecs":{"version":"1.6.0"},"message":"1765028708.433095\tF29k95209tq1wIjful\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:15.715Z","host":{"name":"f6b540842a86"},"log":{"offset":31449,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0e552898ccfee0585d5e0153cea2fbb5934d0e4e15fcc9d4f75d9909e0a03437"},"ecs":{"version":"1.6.0"},"message":"1765028714.647289\tCZKClb445yk8IP4zVc\t172.30.1.12\t48659\t172.30.1.254\t53\tudp\t14372\t0.019605\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.388Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":716572},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"698c922bb4fb3666176cc73b4a031a3fc6786995998661d8545f5bfdb4d83983"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028704.547582\tCgVZqB4qwUcKc3ZH6f\t172.30.1.12\t34590\t172.30.1.254\t53\tudp\tdns\t0.003743\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.586Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":695081},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6dbdbacbc49bac4294e5ceec0b56b1ddd8337c5624e6edbf6c420afa66674142"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028707.296821\tCkMWte2zQjlCurM3\t202.46.62.25\t48702\t172.30.1.2\t443\ttcp\tssl\t2.540616\t1083\t19037\tRSTO\tF\tT\t0\tShADadtfR\t19\t2087\t22\t20299\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.586Z","host":{"name":"f6b540842a86"},"log":{"offset":695335,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"562257bae7897f5b198060b1da98388b95e259843d9a219d2d3f82bb8c83da76"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028705.557244\tCQIaCG2p60XTGoMcg7\t172.30.1.12\t59016\t172.30.1.254\t53\tudp\tdns\t0.002968\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.586Z","host":{"name":"f6b540842a86"},"log":{"offset":695483,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"52ee7f9cd49877d4f72a17a4a7127d68a11542cfb2bcea140441bd257231d5a5"},"ecs":{"version":"1.6.0"},"message":"1765028715.677330\tCgbXsV3hb46m2iwe3\t172.30.1.12\t43206\t172.30.1.254\t53\tudp\t14373\t0.002853\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:17.388Z","host":{"name":"f6b540842a86"},"log":{"offset":716752,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0c7bcee70f30288c1f9b5e541fd4040d97abfba4cf5925b5ee96248c49f05a93"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028709.829215\tCU02tq4xUonOwf2Oy7\t172.30.1.2\t41184\t172.30.4.139\t1514\ttcp\t-\t2.999013\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.586Z","host":{"name":"f6b540842a86"},"log":{"offset":695210,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fda2f55ed547ca1accf035ab5fc262eddcb615e496a7f9d06717595375edabcd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028654.105395\tCyrdYk2JtTJgUvJvY9\t172.30.1.15\t138\t172.30.1.255\t138\tudp\t-\t-\t-\t-\tS0\tT\tT\t0\tD\t1\t229\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:16.586Z","host":{"name":"f6b540842a86"},"log":{"offset":694965,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"70b97c147b99194125a3cad021cdf766460f1d4a97f416b2548ad7e5bf807fbf"},"ecs":{"version":"1.6.0"},"message":"1765028707.248258\tC0NGHi1n9cvxr0uyb4\t202.46.62.68\t11812\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=hwcw&smid=30679&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t266\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tF4AF0jg9ZWPhJBjGf\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:17.668Z","host":{"name":"f6b540842a86"},"log":{"offset":21410,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"feb44229b19a35e7a94735d5afe16f2490888e5b5e1e6de94e359f9601348c19"},"ecs":{"version":"1.6.0"},"message":"1765028716.687343\tCiyRA02fjOfiaF3ZE8\t172.30.1.12\t37688\t172.30.1.254\t53\tudp\t14374\t0.003383\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:18.389Z","host":{"name":"f6b540842a86"},"log":{"offset":716931,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"18cfe3fc54a56704aeef679550376eb9cd5efea9d9173a26b10f52b0a3490637"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028706.567338\tC4j7da2pJNDzqKO1Kd\t172.30.1.12\t33899\t172.30.1.254\t53\tudp\tdns\t0.003208\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:19.588Z","host":{"name":"f6b540842a86"},"log":{"offset":695749,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"045387c66c8c696a2300337222a5789147d32dcf353c99b83e8121e107a80506"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028592.832011\tCyUkbf4Sy2sYV3E1N7\tfe80::c86:954f:5d3e:13c9\t546\tff02::1:2\t547\tudp\t-\t64.003026\t664\t0\tS0\tF\tF\t0\tD\t8\t1048\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:19.587Z","host":{"name":"f6b540842a86"},"log":{"offset":695612,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"70a87ace3c933d97dfb0c2ebb2a0d4394e2beb84a09463b636b8f03bb8eb7716"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028712.828875\tClnSU97xRNHx6zus9\t172.30.1.2\t47462\t172.30.4.139\t1515\ttcp\t-\t2.999365\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:19.588Z","host":{"name":"f6b540842a86"},"log":{"offset":695878,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0659c6e19a7b018dff45caadfe6839c523f0059d6f26c018aa07d9c8efb73b74"},"ecs":{"version":"1.6.0"},"message":"1765028717.697329\tCAOVxa3PPgDotfL7rc\t172.30.1.12\t53381\t172.30.1.254\t53\tudp\t14375\t0.003350\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:19.389Z","host":{"name":"f6b540842a86"},"log":{"offset":717111,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2a9bae5563968b75437e1d635882eebca37565f67b0761b1cbec577239c64535"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028707.577205\tCN9ZN42XF1GU6kTJC4\t172.30.1.12\t53266\t172.30.1.254\t53\tudp\tdns\t0.003464\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:19.588Z","host":{"name":"f6b540842a86"},"log":{"offset":696002,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"047d6d1fa166fbb3a1a46c37ef021be1e9eb8441d109b7798263d80ccedfd9f7"},"ecs":{"version":"1.6.0"},"message":"1765028718.707458\tCTS7vJ2MD6sgeGlbXc\t172.30.1.12\t59370\t172.30.1.254\t53\tudp\t14376\t0.003595\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.390Z","host":{"name":"f6b540842a86"},"log":{"offset":717291,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6f332b8e40f4e99b7d05e03ef46248fa12b939cb617f952f247ffdad4b288968"},"ecs":{"version":"1.6.0"},"message":"1765028718.767862\tC6CZG13AirfelkDre1\t172.30.1.35\t58042\t172.30.1.254\t53\tudp\t61794\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t48.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.390Z","host":{"name":"f6b540842a86"},"log":{"offset":717471,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9c7d43e4683024c83efe3b051974e72e4d804a8853f9da59509422bb61beb7a6"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028713.933009\tCdTJmN3zaVWJyuK9R9\t10.10.10.1\t53650\t10.10.10.200\t8000\ttcp\t-\t0.319289\t32\t0\tSH\tT\tT\t0\tSADF\t6\t352\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.588Z","host":{"name":"f6b540842a86"},"log":{"offset":696262,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b309837eaf9b268c0060879a83d219e57782bde0901f6871bd8ccac686bc6f9e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028708.713026\tCsbDMV3GGI7TrvuFuc\t172.30.1.35\t58444\t172.30.1.254\t53\tudp\tdns\t0.005164\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.588Z","host":{"name":"f6b540842a86"},"log":{"offset":696131,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3627f1be689017c02c969f1c9910a68508fce0493b15f59f62f0239d2109efe0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028708.587811\tC2ASxT18kxQMrMnyHg\t172.30.1.12\t55803\t172.30.1.254\t53\tudp\tdns\t0.002931\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.588Z","host":{"name":"f6b540842a86"},"log":{"offset":696391,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"31b7760b4155a52a8f9873c15c7f19ba7464bda7c7d09593f42ad52aac00fe89"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028698.705899\tCMMFpk2vKU1F07Ixli\t172.30.1.35\t58231\t172.30.1.254\t53\tudp\tdns\t1.145556\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:20.588Z","host":{"name":"f6b540842a86"},"log":{"offset":696520,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c610de88e3ab55b9007e5e13e196edbf6b68ebd9fad8e97a54803dc6e055bc60"},"ecs":{"version":"1.6.0"},"message":"1765028719.717587\tCYpvzu4zAtwWd1TzQd\t172.30.1.12\t35104\t172.30.1.254\t53\tudp\t14377\t0.002427\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:21.397Z","host":{"name":"f6b540842a86"},"log":{"offset":717636,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"050e61794f91b5578589d7e9023b66371538ef3d7564ebe195c277709fd4292f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028709.597405\tC7GBKF3Y3uGYQZxt6i\t172.30.1.12\t56780\t172.30.1.254\t53\tudp\tdns\t0.003267\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:21.588Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":696651},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5193ccfc27e129d757c9480d11573987ecad833532e828ff5d6d111aeb1b7c4b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028710.607586\tCT186o4UCc7NxfLfv5\t172.30.1.12\t50377\t172.30.1.254\t53\tudp\tdns\t0.002325\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:22.589Z","host":{"name":"f6b540842a86"},"log":{"offset":696780,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2c8f731e5606a0c4c7c83ec20215525f7423c93527aaea86397ce534d492f496"},"ecs":{"version":"1.6.0"},"message":"1765028720.727437\tCmO6VX2TQxPYznk075\t172.30.1.12\t54841\t172.30.1.254\t53\tudp\t14378\t0.003507\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:22.398Z","host":{"name":"f6b540842a86"},"log":{"offset":717816,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5fe3b3fb5832317ed84b53124096b80d213d62b7f52f42166a65af41fe5001ae"},"ecs":{"version":"1.6.0"},"message":"1765028721.737392\tC7GyEuEMiRlQFhcMd\t172.30.1.12\t52105\t172.30.1.254\t53\tudp\t14379\t0.003588\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:23.398Z","host":{"name":"f6b540842a86"},"log":{"offset":717996,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c70213f1ff997a3711f61b0a5074de878cd99b7d2f5de11bc4cc907f3b37335a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028711.617286\tCVj0e91MEdUmC0wi8g\t172.30.1.12\t48131\t172.30.1.254\t53\tudp\tdns\t0.002635\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:23.589Z","host":{"name":"f6b540842a86"},"log":{"offset":697049,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b3e09eab4b70ce990593b092d00200f510bc4ca1393c57e96d71d24305dc43b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028636.053645\tCC3rKv4mAox93LtpM5\t172.30.1.35\t61714\t74.125.130.94\t443\tudp\t-\t25.173706\t4359\t9332\tSF\tT\tF\t0\tDd\t11\t4667\t14\t9724\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:23.589Z","host":{"name":"f6b540842a86"},"log":{"offset":696909,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6f799bf6c0eb03a91cfc9341ff78bbe3d9fa34d53f8bb78c59ed9068920ff500"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765025090.166137\tCUDl0p4TmW7G0u3ZV6\t202.46.62.34\t64540\t172.30.1.2\t443\ttcp\t-\t31.601505\t0\t0\tS1\tF\tT\t0\tSh\t2\t120\t7\t420\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:23.589Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":697178},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"57ebffc042ece625b76de8dade1e7fcdb00b13acb762f2a27e6f7f6071e387fc"},"ecs":{"version":"1.6.0"},"message":"1765028722.747403\tCeHc9f3GZ2ID3j5dh\t172.30.1.12\t39974\t172.30.1.254\t53\tudp\t14380\t0.002806\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:24.399Z","host":{"name":"f6b540842a86"},"log":{"offset":718175,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ad18f6404b63e8f6d3b51ee1818d1e8830b4128542766d1be5a992eb83fc7ca5"},"ecs":{"version":"1.6.0"},"message":"1765028723.757406\tCwb0mW2yhxx7Yzafkd\t172.30.1.12\t54286\t172.30.1.254\t53\tudp\t14381\t0.002806\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:25.399Z","host":{"name":"f6b540842a86"},"log":{"offset":718354,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2e3ea7b4ecc3e3bdffffb766633c16134a10dd35f9eeaa2459cac3629a7a54be"},"ecs":{"version":"1.6.0"},"message":"1765028723.710022\tCLT3rK1VTEKcYwbJl8\t172.30.1.35\t53219\t172.30.1.254\t53\tudp\t29689\t0.004948\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t43.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:25.399Z","host":{"name":"f6b540842a86"},"log":{"offset":718534,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fe8c7dde94d06a2191ad8815d55cab7229f89c1322d87e30077256fcf5f5c22e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028712.627371\tCAJTv947pc92hZdjJb\t172.30.1.12\t43984\t172.30.1.254\t53\tudp\tdns\t0.002906\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:24.590Z","host":{"name":"f6b540842a86"},"log":{"offset":697306,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c5f47372236db4679b4421f4fc9cf7d46cc190b76c07ca4ec96e1c546824e8a2"},"ecs":{"version":"1.6.0"},"message":"1765028724.767380\tCN8XJa3NOskl8PVs36\t172.30.1.12\t48742\t172.30.1.254\t53\tudp\t14382\t0.002829\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:26.400Z","host":{"name":"f6b540842a86"},"log":{"offset":718706,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bf9f10f141afbf3123512bc89cb03507c5de1f2575ef230974ef6add79d568e8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028713.708068\tCx5t3c13ELOFNnLX75\t172.30.1.35\t54377\t172.30.1.254\t53\tudp\tdns\t0.004678\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:25.590Z","host":{"name":"f6b540842a86"},"log":{"offset":697435,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"96c67e66d9248f72ba21ae339c9c74af6946c91186c6b94a3b79b205bbde2757"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028713.637287\tCVwrri1NEkDkEz1b08\t172.30.1.12\t56153\t172.30.1.254\t53\tudp\tdns\t0.002893\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:25.590Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":697566},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3d6e7a534f981538c677d6ae594a60286bbc6db70067c3c61b3c4e8bf75cd57c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028714.647289\tCZKClb445yk8IP4zVc\t172.30.1.12\t48659\t172.30.1.254\t53\tudp\tdns\t0.019605\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:26.591Z","host":{"name":"f6b540842a86"},"log":{"offset":697695,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9c2cb6d97761ab81f684bfeefef3cf442c3021dfff244843ad9fb26a0f8e5d60"},"ecs":{"version":"1.6.0"},"message":"1765028725.777757\tCurdfr3vlyQb2xfCR6\t172.30.1.12\t44767\t172.30.1.254\t53\tudp\t14383\t0.003793\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:27.400Z","host":{"name":"f6b540842a86"},"log":{"offset":718886,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7b62f60688fa94e274017bc161e480272638955ff24f71e1d63ebafa0caf64f2"},"ecs":{"version":"1.6.0"},"message":"1765028706.868234\tCXzG5p4LTciP8Vynbj\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\t0\t-\tpower-consumption-ssc.local\t1\tC_INTERNET\t255\t*\t-\t-\tF\tF\tF\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.400Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":719212},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6af06be5ae18439527f30d3ef23a7dcb09e283a85ec22a6fc93848155a61e6d7"},"ecs":{"version":"1.6.0"},"message":"1765028706.567568\tCXzG5p4LTciP8Vynbj\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\t0\t-\tpower-consumption-ssc.local\t1\tC_INTERNET\t255\t*\t-\t-\tF\tF\tF\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.400Z","host":{"name":"f6b540842a86"},"log":{"offset":719066,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0f978c61f57b11d8f098821c0c26721ed486a156c423b07e5d0c56cbee4b5a4f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028715.677330\tCgbXsV3hb46m2iwe3\t172.30.1.12\t43206\t172.30.1.254\t53\tudp\tdns\t0.002853\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:27.597Z","host":{"name":"f6b540842a86"},"log":{"offset":697824,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"19bf6ec8d84a7ca09c10c9f746358a740e490b381c7afb4709fdf917c4046077"},"ecs":{"version":"1.6.0"},"message":"1765028726.787569\tCg1A7WZYgd7zgmhA1\t172.30.1.12\t34336\t172.30.1.254\t53\tudp\t14384\t0.003116\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.400Z","host":{"name":"f6b540842a86"},"log":{"offset":719358,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"877cfe7964a5519b6ebeecbc8c8084f839bec8d247be0b01d9e5ff27b5733403"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028716.687343\tCiyRA02fjOfiaF3ZE8\t172.30.1.12\t37688\t172.30.1.254\t53\tudp\tdns\t0.003383\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.597Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":698082},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4f3a1f13edf4a2a7c0bde6595214ca8948b5679338c9a62edb0de564f58b727a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765028706.281724\tCXzG5p4LTciP8Vynbj\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\tdns\t1.988302\t1103\t0\tS0\tT\tF\t0\tD\t4\t1215\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.597Z","host":{"name":"f6b540842a86"},"log":{"offset":697952,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5e1fd17f83e6d580c47b06d2028aa01e368031a8829f8f0beae042f48c68d655"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028666.434731\tC67lDD1YjFB6pnTHx5\tfe80::b2be:76ff:fec9:7610\t130\tff02::1\t131\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.597Z","host":{"name":"f6b540842a86"},"log":{"offset":698211,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ce1a51b8d79870abd4a858bc708d2da5afc1e0be7a8da0acd2a1f007286bb462"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028666.768160\tCIwlCmXkuU07Taiw4\tfe80::2a87:baff:fee8:8f52\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:28.597Z","host":{"name":"f6b540842a86"},"log":{"offset":698337,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"67b680ea2e9ee916400af9674c9885113ca3425ac98e19a85f14a0297c50b431"},"ecs":{"version":"1.6.0"},"message":"1765028727.809147\tC8EISE2dF5uqN4Touf\t172.30.1.12\t46427\t172.30.1.254\t53\tudp\t14385\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:29.400Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":719537},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cc0250773f0b2568cceaa6d937be3280db3be65ff89b575308868d87ddf830dc"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028717.697329\tCAOVxa3PPgDotfL7rc\t172.30.1.12\t53381\t172.30.1.254\t53\tudp\tdns\t0.003350\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:29.598Z","host":{"name":"f6b540842a86"},"log":{"offset":698462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5caf4f9839dffd8b266ea065da9924a1c75b05a34ac25a9bf5c6d7e9626d9222"},"ecs":{"version":"1.6.0"},"message":"1765028728.807472\tCUkuND1FRiwZrSFYq1\t172.30.1.12\t59036\t172.30.1.254\t53\tudp\t14386\t0.003558\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:30.403Z","host":{"name":"f6b540842a86"},"log":{"offset":719710,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3128b9e9bd39aad297fbae94ea4c297d432173a5a6a00f42d09efdd0044989cf"},"ecs":{"version":"1.6.0"},"message":"1765028728.753252\tCxe9Zg4XEZ1Vf4TEd3\t172.30.1.35\t63729\t8.8.8.8\t53\tudp\t45892\t0.027603\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t499.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:30.403Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":719890},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9a8336048b81749683e77f1b703a0bf47fd679c5dd9250cb2d0da9f2fce6937a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028718.714265\tC6CZG13AirfelkDre1\t172.30.1.35\t58042\t172.30.1.254\t53\tudp\tdns\t0.004405\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:30.599Z","host":{"name":"f6b540842a86"},"log":{"offset":698970,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ee018f31e47f835c575bd3104a81aefccaacb872d9f4c97b25203603073f8304"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765028724.403087\tCWkrV94gsdopt2uYU5\t172.30.2.16\t62422\t172.30.1.35\t7680\ttcp\t-\t0.002142\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:30.599Z","host":{"name":"f6b540842a86"},"log":{"offset":699101,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5692a64c5e854bde28e71a8daab6862cc0c4dad9fadc098e7be820700a50d01a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765028719.717587\tCYpvzu4zAtwWd1TzQd\t172.30.1.12\t35104\t172.30.1.254\t53\tudp\tdns\t0.002427\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:31.599Z","host":{"name":"f6b540842a86"},"log":{"offset":699235,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"10ae127220d9b696c6f375ea245f9327bd86dfaaf64c648c924c8c89db04f362"},"ecs":{"version":"1.6.0"},"message":"1765028729.817489\tCJdsym14hzpNcP7R5a\t172.30.1.12\t46706\t172.30.1.254\t53\tudp\t14387\t0.003585\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:31.403Z","host":{"name":"f6b540842a86"},"log":{"offset":720058,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ed92f8777ba77360cb6da178e09cf023a6c4ade367f122b6fa859470bc1c4be0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765028669.380161\tCU60JR15uGXIeXbAZ\tfe80::c251:7eff:fefb:e9d7\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t96\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:45:30.599Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":698846},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1f83e9d752324cac3c1dc5f9a22d1810fd336d12011a16b7c71af193d0f77f6e"},"ecs":{"version":"1.6.0"},"message":"1765029132.953566\tCssGhb33wKoDCaJEF8\t172.30.1.12\t57464\t172.30.1.254\t53\tudp\t14783\t0.001586\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:14.734Z","host":{"name":"f6b540842a86"},"log":{"offset":817208,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ffa94900b37d6487e0a619cf12b02fcdd704aebb070b960dd15e7dd3a0fce696"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765029122.851865\tChyJRp4MCgqCAuxxEi\t172.30.1.12\t43958\t172.30.1.254\t53\tudp\tdns\t0.002828\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:14.062Z","host":{"name":"f6b540842a86"},"log":{"offset":798542,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5112861a21cd8e361bf3c8eb16efa80c565bf0ec075a71eaddde508c2cc86dcb"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765029123.861599\tC7KBIj1nEdWluy3xj\t172.30.1.12\t44100\t172.30.1.254\t53\tudp\tdns\t0.003306\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:15.063Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":798801},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b22d2e51fc4fbb894116d065ab3201648e0726ae6bb56285f89be4d89029c2df"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765029123.718714\tC3HwTF32KQ3cmpOv5\t172.30.1.35\t56330\t172.30.1.254\t53\tudp\tdns\t0.004749\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:15.063Z","host":{"name":"f6b540842a86"},"log":{"offset":798671,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ef8c5fc28912509027fcc7bc5f32d11a3da754debd03d432df4878e3dc127645"},"ecs":{"version":"1.6.0"},"message":"1765029133.748668\tCCSwnDJ8kjL8Ooeug\t172.30.1.35\t63892\t172.30.1.254\t53\tudp\t7802\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2040.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:15.735Z","host":{"name":"f6b540842a86"},"log":{"offset":817388,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"16a7c264cee776e8b1f57a0d69e489e03ac22bc23ae45a1f56aaf0207ebba15c"},"ecs":{"version":"1.6.0"},"message":"1765029134.004889\tC5cNe83HQ2kLkrBGY5\t172.30.1.12\t41763\t172.30.1.254\t53\tudp\t14784\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:15.735Z","host":{"name":"f6b540842a86"},"log":{"offset":817553,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8199e942ca7fde27708b53e29fd3fd4e6f452676244feba5694bfa4feb04e8b7"},"ecs":{"version":"1.6.0"},"message":"1765029134.971612\tCUGJHg2i88dq0kRkxa\t172.30.1.12\t38861\t172.30.1.254\t53\tudp\t14785\t0.002685\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:16.735Z","host":{"name":"f6b540842a86"},"log":{"offset":817726,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"13234822f4f634ad993819c1aa7eef19c374e1fb2aa0e41bfaed2b6885c3995f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765029124.871491\tCo7oAJ2t7SOMkgE9rc\t172.30.1.12\t39319\t172.30.1.254\t53\tudp\tdns\t0.003380\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:16.063Z","host":{"name":"f6b540842a86"},"log":{"offset":798929,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d78f97f7420d114b5a355f5cd2b8f86d4859f211cd95a378ea359eabf764996e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765029125.883042\tCqmG74495oZOm939Z4\t172.30.1.12\t37411\t172.30.1.254\t53\tudp\tdns\t0.001218\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T13:52:17.064Z","host":{"name":"f6b540842a86"},"log":{"offset":799058,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}