Kafdrop: Topic: logstash-local-network: Messages

Offset: 1505649 Key: Timestamp: 2025-12-06 16:06:32.663 Headers: empty

{"@version":"1","event":{"hash":"bd19f5825b97d764347101815a864f179ce87bf9aafb148b6e334dc8dc38fa83"},"ecs":{"version":"1.6.0"},"message":"1765037185.352419\tFABsTb3DEAZsAPxQ7d\t3\t33026FE8AA46D72F3A6F941C840000026FE8AA\tCN=*.events.data.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure RSA TLS Issuing CA 07,O=Microsoft Corporation,C=US\t1759196696.000000\t1774748696.000000\trsaEncryption\tsha384WithRSAEncryption\trsa\t2048\t65537\t-\t*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com,*.events.data.msn.cn,events.data.msn.cn,*.vortex.data.microsoft.com,vortex.data.microsoft.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:32.223Z","host":{"name":"f6b540842a86"},"log":{"offset":7366,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505650 Key: Timestamp: 2025-12-06 16:06:32.663 Headers: empty

{"@version":"1","event":{"hash":"99869cdb5ac69e6ce4b26d1335fb98e4c4463821b2afa77307c7477864d867d2"},"ecs":{"version":"1.6.0"},"message":"1765037186.653921\tFwVCC24IfX8jzPr3ak\t3\t33027108D96F900D42509B6A0E0000027108D9\tCN=*.events.data.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure RSA TLS Issuing CA 07,O=Microsoft Corporation,C=US\t1759235148.000000\t1774787148.000000\trsaEncryption\tsha384WithRSAEncryption\trsa\t2048\t65537\t-\t*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com,*.events.data.msn.cn,events.data.msn.cn,*.vortex.data.microsoft.com,vortex.data.microsoft.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:32.223Z","host":{"name":"f6b540842a86"},"log":{"offset":8007,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505651 Key: Timestamp: 2025-12-06 16:06:32.663 Headers: empty

{"@version":"1","event":{"hash":"7b8e04e09850695ffa313459b2659ab808ef0abd61b5856cb54a97125a744ceb"},"ecs":{"version":"1.6.0"},"message":"1765037188.791170\tCBUtcY15d2ENIcilu9\t172.30.1.35\t63502\t172.30.1.254\t53\tudp\t43515\t2.005566\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t855.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:31.559Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":107594},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505652 Key: Timestamp: 2025-12-06 16:06:33.665 Headers: empty

{"@version":"1","event":{"hash":"72ae1ae2696c2b8b06264e6ff9c41eb5db6c66a2e37365086bf3317881aab503"},"ecs":{"version":"1.6.0"},"message":"1765037191.546406\tCq1Chu4ggh0wkLe8La\t172.30.1.12\t58287\t172.30.1.254\t53\tudp\t22674\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:32.561Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":107947},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505653 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"465785fb46c582ad6f38702f16fc3c7fffe9652cc2de0dd1cd6b1305b6bdca51"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037181.439573\tCgLsvP372uymcXZ5U1\t172.30.1.12\t53972\t172.30.1.254\t53\tudp\tdns\t0.002628\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:34.640Z","host":{"name":"f6b540842a86"},"log":{"offset":107434,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505654 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"60f1a166db3a0b51f2701e596f4507eb902d59018c18267507ddcfa5bbc089f6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037182.723530\tCZfoyf26OVCALWvaA4\t172.30.1.3\t36591\t8.8.8.8\t53\tudp\tdns\t0.036251\t45\t126\tSF\tT\tF\t0\tDd\t1\t73\t1\t154\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:34.640Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":107563},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505655 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"b74e5bb9115e15c0a5e5c73add58768e17839dfec31f0cdacf05a4594d2b7ab2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037182.454406\tCqvR4v23CDqEfJRhZ1\t172.30.1.12\t40536\t172.30.1.254\t53\tudp\tdns\t0.002726\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:34.640Z","host":{"name":"f6b540842a86"},"log":{"offset":107688,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505656 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"93eaca38e907d404155215f2605be27b6df50ad10053182db511d323551550bc"},"ecs":{"version":"1.6.0"},"message":"1765037192.560330\tC2Lf5V2VjBrIfNKH9j\t172.30.1.12\t50282\t172.30.1.254\t53\tudp\t22675\t0.002075\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.567Z","host":{"name":"f6b540842a86"},"log":{"offset":108120,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505657 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"da74ee66f1dd1378be6a1eaf7f6150e5c6750c8c7a8a319ee18f725c11d16f3a"},"ecs":{"version":"1.6.0"},"message":"1765037193.559688\tCPFHp41dQFlWlv02B2\t172.30.1.12\t36528\t172.30.1.254\t53\tudp\t22676\t0.003730\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.567Z","host":{"name":"f6b540842a86"},"log":{"offset":108300,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505658 Key: Timestamp: 2025-12-06 16:06:35.744 Headers: empty

{"@version":"1","event":{"hash":"23078117cbc47436ed9cf99dffe98f4aadd5eb56d7dc9ad2cc99e2dc3f98838f"},"ecs":{"version":"1.6.0"},"message":"1765037193.849123\tCwe5mRPg5bDHDHzQf\t172.30.1.35\t54201\t8.8.8.8\t53\tudp\t50937\t0.004956\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1441.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.567Z","host":{"name":"f6b540842a86"},"log":{"offset":108480,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505659 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"e65f89a7b1b821a8eb9da10e27d89db7e243b3d15b56f023fb45061f2f0c5239"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037173.787610\tCco4x3w0qz0UDGN8l\t172.30.1.35\t65440\t172.30.1.254\t53\tudp\tdns\t2.009129\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.642Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":107945},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505660 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"d10f0a07ddf535b7e4f7ef966386452ce69df56633c5dcccabbac83c166f06a3"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037183.461037\tCLfEV48279WjAPfx9\t172.30.1.12\t46194\t172.30.1.254\t53\tudp\tdns\t0.005080\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.642Z","host":{"name":"f6b540842a86"},"log":{"offset":107817,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505661 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"81c93b64eabb3b4552783c3c5a9f0685e330dd3d323a42e564b83ab74a6e62f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037184.469818\tCSroWv2ypHj8I0n3b9\t172.30.1.12\t41344\t172.30.1.254\t53\tudp\tdns\t0.002535\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.642Z","host":{"name":"f6b540842a86"},"log":{"offset":108201,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505662 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"085b0eef9dd7bc4aa2b7bdc980dfe665bc6660517094a943f52e5923dd9fc8d8"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037183.836333\tCUSFQ13Cgm0lgW6lY2\t172.30.1.35\t65455\t8.8.8.8\t53\tudp\tdns\t0.027804\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:35.642Z","host":{"name":"f6b540842a86"},"log":{"offset":108075,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505663 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"9fef6d399178d022dbd43776a6047fa2462c0aa8ef045b9c0d803fa98bd83ec7"},"ecs":{"version":"1.6.0"},"message":"1765037194.569730\tCs3PkZ2Ge970qgucq2\t172.30.1.12\t51150\t172.30.1.254\t53\tudp\t22677\t0.002904\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:36.568Z","host":{"name":"f6b540842a86"},"log":{"offset":108648,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505664 Key: Timestamp: 2025-12-06 16:06:36.746 Headers: empty

{"@version":"1","event":{"hash":"977ae60f6a43e6d96117e871b79b3debea3840165acb8ca52d22357667305652"},"ecs":{"version":"1.6.0"},"message":"1765037195.579700\tCOj25uGo22fGyhSi8\t172.30.1.12\t48805\t172.30.1.254\t53\tudp\t22678\t0.003126\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:36.568Z","host":{"name":"f6b540842a86"},"log":{"offset":108828,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505665 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"b6be5798ed160d8f008f83aca403153e5db2ee19c7c45a5c679c0f1af4250907"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037131.346291\tC2HHdy327SK5Pn6In6\t172.30.1.222\t65222\t239.255.255.250\t1900\tudp\t-\t3.020756\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:36.645Z","host":{"name":"f6b540842a86"},"log":{"offset":108330,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505666 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"56fae89230ae1e6fb46a94b2c1b4949ebe05bf36f2da7f2f1108375df0a7bccf"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037134.828014\tCdwPcWNfUR06wsdhj\t172.30.1.132\t56503\t216.239.35.12\t123\tudp\tntp\t0.031908\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:36.645Z","host":{"name":"f6b540842a86"},"log":{"offset":108462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505667 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"12058849ad0db1a932358662101f2a12c288d7ead7a94c55d6e5231193b4dcd1"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037185.479607\tCX6sLz1mlMVdiHWNp9\t172.30.1.12\t52605\t172.30.1.254\t53\tudp\tdns\t0.002971\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:36.645Z","host":{"name":"f6b540842a86"},"log":{"offset":108593,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505668 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"055ca12fd01161b701a3bdbc08de766d56166deb1514829227362f0d4ec63640"},"ecs":{"version":"1.6.0"},"message":"1765037185.076491\tCjOcIM2mFfvQSr7922\t172.30.1.35\t56352\t20.42.73.24\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp384r1\tself.events.data.microsoft.com\tF\t-\t-\tT\tFABsTb3DEAZsAPxQ7d,FMw5qx3MK43IgBDMwi\t(empty)\tCN=*.events.data.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure RSA TLS Issuing CA 07,O=Microsoft Corporation,C=US\t-\t-\tok\ta0e9f5d64349fb13191bc781f81f42e1\t986571066668055ae9481cb84fda634a","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:37.198Z","host":{"name":"f6b540842a86"},"log":{"offset":7933,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505669 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"783a70d42a7b220ba4f039fa78b68fd34495ab1067f9c5c2ae0d42b215d1eb31"},"ecs":{"version":"1.6.0"},"message":"1765037186.444947\tCGQZEl1dZBIUO4mrX4\t172.30.1.35\t56353\t20.189.173.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp384r1\tself.events.data.microsoft.com\tF\t-\t-\tT\tFwVCC24IfX8jzPr3ak,FqAaOn3IXma3m6UkTj\t(empty)\tCN=*.events.data.microsoft.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US\tCN=Microsoft Azure RSA TLS Issuing CA 07,O=Microsoft Corporation,C=US\t-\t-\tok\ta0e9f5d64349fb13191bc781f81f42e1\t986571066668055ae9481cb84fda634a","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:37.198Z","host":{"name":"f6b540842a86"},"log":{"offset":8363,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505670 Key: Timestamp: 2025-12-06 16:06:37.749 Headers: empty

{"@version":"1","event":{"hash":"de1119588f3db28e6761d5bd51cb09a54493034791571afeaafaf2f5f62fa519"},"ecs":{"version":"1.6.0"},"message":"1765037193.849123\tCcXUa63bCSZfBZJAdb\t172.30.1.35\t54201\t172.30.1.254\t53\tudp\t50937\t1.947764\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t850.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:37.568Z","host":{"name":"f6b540842a86"},"log":{"offset":109007,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505671 Key: Timestamp: 2025-12-06 16:06:39.671 Headers: empty

{"@version":"1","event":{"hash":"ec674d36cf60675f7e5b4bab7d5b1bdfcf36324db25f987a8b6a67203f8f9f3a"},"ecs":{"version":"1.6.0"},"message":"1765037196.589683\tCK1Lh03DwaUfXLEwn8\t172.30.1.12\t59700\t172.30.1.254\t53\tudp\t22679\t0.003112\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:38.568Z","host":{"name":"f6b540842a86"},"log":{"offset":109180,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505672 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"1ec54aa6048a5f1de7553ee904bc118caeb412643d88cc06be98444aa8224ca9"},"ecs":{"version":"1.6.0"},"message":"1765037197.599757\tClT9Rj2eX6XPModMwi\t172.30.1.12\t39599\t172.30.1.254\t53\tudp\t22680\t0.002874\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.569Z","host":{"name":"f6b540842a86"},"log":{"offset":109360,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505673 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"ad4a6648cef01d4be9bd0ce88ea5d26906e4269753c1aeecc8d1416a504317b2"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037186.489754\tCL8cuHKe1mOsf85cj\t172.30.1.12\t44195\t172.30.1.254\t53\tudp\tdns\t0.002797\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":108853},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505674 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"6d5b3a090487c5cf70b93902716a59022806ed25d238edae0c865d1e78e8226b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037186.226463\tCVacnk1fs6JIbdpnfc\t172.30.1.35\t54522\t172.30.1.254\t53\tudp\tdns\t0.002267\t48\t169\tSF\tT\tT\t0\tDd\t1\t76\t1\t197\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":108722},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505675 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"9efa3e5bf609a9f933ddd111848c3942136d54a6973a3374791d42b8080792f4"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037187.499631\tCBRv9Y2OEyh7BHPr58\t172.30.1.12\t39530\t172.30.1.254\t53\tudp\tdns\t0.003178\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"offset":108981,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505676 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"fcd7cba9078768233de6a80302647bcd937192994ed948b373ddb1a15f54309d"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037186.234063\tCGQZEl1dZBIUO4mrX4\t172.30.1.35\t56353\t20.189.173.2\t443\ttcp\tssl\t6.195059\t2312\t7387\tRSTO\tT\tF\t0\tShADdaR\t13\t2844\t10\t7799\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"offset":109110,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505677 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"94a3af3217b926229bf98c6c83258df536eee15a86a6ea8e6811471e125054b1"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037188.509657\tCQISNF1TlOVJT9jo7i\t172.30.1.12\t49969\t172.30.1.254\t53\tudp\tdns\t0.003224\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":109257},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505678 Key: Timestamp: 2025-12-06 16:06:40.674 Headers: empty

{"@version":"1","event":{"hash":"462e60896ebdd688211327b478f3e58e1752c08e5f0cd1406714ca430102fcc4"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037178.783911\tCMe5pR27WaDT6fIS29\t172.30.1.35\t63603\t172.30.1.254\t53\tudp\tdns\t2.012814\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:39.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":109386},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505679 Key: Timestamp: 2025-12-06 16:06:41.675 Headers: empty

{"@version":"1","event":{"hash":"6fbe39bc0b86176709f13f54f96d77ea1375d6475abee4eb0044d45dee94fd3c"},"ecs":{"version":"1.6.0"},"message":"1765037198.609707\tCvJpRr4jqOfFxHbyMi\t172.30.1.12\t57566\t172.30.1.254\t53\tudp\t22681\t0.003314\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:40.571Z","host":{"name":"f6b540842a86"},"log":{"offset":109540,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505680 Key: Timestamp: 2025-12-06 16:06:41.675 Headers: empty

{"@version":"1","event":{"hash":"5d61fa2ae65b5694a0305336ddd16f11352d67c627c3646974876d2f6d556672"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037188.835549\tCyE6AJ1kEZH7QpAOwg\t172.30.1.35\t63502\t8.8.8.8\t53\tudp\tdns\t0.024284\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:40.646Z","host":{"name":"f6b540842a86"},"log":{"offset":109517,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505681 Key: Timestamp: 2025-12-06 16:06:41.675 Headers: empty

{"@version":"1","event":{"hash":"4208c886f137d9b10794b8e0f33f65993024cf4fb185bec3b32c0f44c3e92cc4"},"ecs":{"version":"1.6.0"},"message":"1765037198.859127\tCrleSc4Tijm0bb399k\t172.30.1.35\t61609\t8.8.8.8\t53\tudp\t49178\t0.002679\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2869.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:40.571Z","host":{"name":"f6b540842a86"},"log":{"offset":109720,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505682 Key: Timestamp: 2025-12-06 16:06:42.676 Headers: empty

{"@version":"1","event":{"hash":"5e796ce00693c8b1968db182d4fe28543b07a4856f01b6408cc13138f762043f"},"ecs":{"version":"1.6.0"},"message":"1765037199.619753\tCSM1Hg3MDuV1OpdKsj\t172.30.1.12\t34164\t172.30.1.254\t53\tudp\t22682\t0.002813\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:41.573Z","host":{"name":"f6b540842a86"},"log":{"offset":109889,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505683 Key: Timestamp: 2025-12-06 16:06:42.676 Headers: empty

{"@version":"1","event":{"hash":"0f5cb77401a85f30150a46c57429818b9278a8bc3b524472b5cf0c218af4a60f"},"ecs":{"version":"1.6.0"},"message":"1765037198.864681\tCOrrT63rKGGWe57zOa\t172.30.1.35\t61609\t172.30.1.254\t53\tudp\t49178\t1.942076\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t845.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:42.573Z","host":{"name":"f6b540842a86"},"log":{"offset":110069,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505684 Key: Timestamp: 2025-12-06 16:06:42.676 Headers: empty

{"@version":"1","event":{"hash":"525879f5938b6e9959516f46fa5fbeca14cce31af880cdf69f03403704f9f48a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037189.519661\tCoC1M73epC76ZThWcg\t172.30.1.12\t57929\t172.30.1.254\t53\tudp\tdns\t0.003391\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:41.646Z","host":{"name":"f6b540842a86"},"log":{"offset":109643,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505685 Key: Timestamp: 2025-12-06 16:06:43.677 Headers: empty

{"@version":"1","event":{"hash":"14d2521c0501c33f6c088d8175fd129dbca090658826a8755c4dd83aaaf355da"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037190.529886\tCQq3rE1qztBSbxi6D2\t172.30.1.12\t59396\t172.30.1.254\t53\tudp\tdns\t0.002484\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:42.647Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":109772},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505686 Key: Timestamp: 2025-12-06 16:06:43.677 Headers: empty

{"@version":"1","event":{"hash":"af0deba3d63435e3d7df78d3a836f0ae1379c2d832353ed7b453d25857726269"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037138.821725\tC7Uwgh3ZwIbP3CrKx8\t172.30.1.98\t64761\t239.255.255.250\t1900\tudp\t-\t3.028220\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:42.647Z","host":{"name":"f6b540842a86"},"log":{"offset":110031,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505687 Key: Timestamp: 2025-12-06 16:06:43.677 Headers: empty

{"@version":"1","event":{"hash":"a15e939cfd7b1d1d188f215e371dfd279f89fea1aa7da9d9e0d9b99d4e8f1c29"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037191.546406\tCq1Chu4ggh0wkLe8La\t172.30.1.12\t58287\t172.30.1.254\t53\tudp\tdns\t0.109598\t44\t60\tSF\tT\tT\t0\t^dD\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:42.647Z","host":{"name":"f6b540842a86"},"log":{"offset":109901,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505688 Key: Timestamp: 2025-12-06 16:06:43.677 Headers: empty

{"@version":"1","event":{"hash":"bdfd08cc032716b6a9c835099357eb91e7a242d9bd0ec48188ac2f5ad08100ef"},"ecs":{"version":"1.6.0"},"message":"1765037200.630129\tCRFzIe3SEnoE8sMSvd\t172.30.1.12\t37535\t172.30.1.254\t53\tudp\t22683\t0.003291\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:42.573Z","host":{"name":"f6b540842a86"},"log":{"offset":110242,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505689 Key: Timestamp: 2025-12-06 16:06:44.686 Headers: empty

{"@version":"1","event":{"hash":"a5f4aaa5687a982d982848c78b79aec0c68c6ac379ef3e6b76350d612fd38013"},"ecs":{"version":"1.6.0"},"message":"1765037202.649871\tCXFRC44aR3Q2OretRh\t172.30.1.12\t60367\t172.30.1.254\t53\tudp\t22685\t0.002676\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:43.574Z","host":{"name":"f6b540842a86"},"log":{"offset":110602,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505690 Key: Timestamp: 2025-12-06 16:06:44.686 Headers: empty

{"@version":"1","event":{"hash":"0a195377fcc44bbdc8945152a535f29217f31c8da8f3e603280c44ebc40b1af3"},"ecs":{"version":"1.6.0"},"message":"1765037201.639845\tCnx3xs3uGu3n4N8cwa\t172.30.1.12\t49994\t172.30.1.254\t53\tudp\t22684\t0.002902\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:43.574Z","host":{"name":"f6b540842a86"},"log":{"offset":110422,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505691 Key: Timestamp: 2025-12-06 16:06:44.686 Headers: empty

{"@version":"1","event":{"hash":"410b1606365e7171cceecf23a6a47547795cbb584e662b49f5e1c149ded125c8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037197.227769\tC8u0tn24hrblZYWz76\t172.30.1.2\t43056\t172.30.4.139\t1514\ttcp\t-\t2.999895\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:43.647Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":110162},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505692 Key: Timestamp: 2025-12-06 16:06:45.751 Headers: empty

{"@version":"1","event":{"hash":"4eaa9a964e0e7be3ca9beaa90b2a0af926822693e300153da16e61bc09cb35f6"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037192.560330\tC2Lf5V2VjBrIfNKH9j\t172.30.1.12\t50282\t172.30.1.254\t53\tudp\tdns\t0.002075\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:44.648Z","host":{"name":"f6b540842a86"},"log":{"offset":110287,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505693 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"049e64230918944c83b88f121eb0ddccd2ae7ce0ed004b7fc97d7a3aacb087fe"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037193.559688\tCPFHp41dQFlWlv02B2\t172.30.1.12\t36528\t172.30.1.254\t53\tudp\tdns\t0.003730\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:45.649Z","host":{"name":"f6b540842a86"},"log":{"offset":110541,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505694 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"318cc458607099226d7ec3ea0782e7cc8205035c0220700881fe18911842117a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037183.803822\tCZPBJc1BjzV24Zp9K4\t172.30.1.35\t65455\t172.30.1.254\t53\tudp\tdns\t2.012921\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:45.649Z","host":{"name":"f6b540842a86"},"log":{"offset":110670,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505695 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"4fb8e5a60965c2935826e4a90bf87c3b60182e5503320acb91df726ebd5a1b11"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037193.825562\tCwe5mRPg5bDHDHzQf\t172.30.1.35\t54201\t8.8.8.8\t53\tudp\tdns\t0.028517\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:45.649Z","host":{"name":"f6b540842a86"},"log":{"offset":110416,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505696 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"a2b1cf14f50e821c2c983241acb8ef5372491f4f2a609d82e6dec4a24e966b7f"},"ecs":{"version":"1.6.0"},"message":"1765037203.660137\tC0dtU834qI8Llpgtj3\t172.30.1.12\t49815\t172.30.1.254\t53\tudp\t22686\t0.002628\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:46.575Z","host":{"name":"f6b540842a86"},"log":{"offset":110782,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505697 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"fd06ff03d53f3916efcf3087f0c64521d0d92bd32636027dc45d5285b1d12eca"},"ecs":{"version":"1.6.0"},"message":"1765037203.828435\tCCMPDd4hkmLG83j0xj\t172.30.1.35\t58538\t8.8.8.8\t53\tudp\t37618\t0.027400\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1431.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:46.575Z","host":{"name":"f6b540842a86"},"log":{"offset":110962,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505698 Key: Timestamp: 2025-12-06 16:06:46.753 Headers: empty

{"@version":"1","event":{"hash":"27ae8748acdc3e387943a4a156acbcdcf39dd68404df891e7c0cdef48fe03e64"},"ecs":{"version":"1.6.0"},"message":"1765037204.669792\tCyNPUw3iZm1eyZfww4\t172.30.1.12\t55746\t172.30.1.254\t53\tudp\t22687\t0.002732\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:46.575Z","host":{"name":"f6b540842a86"},"log":{"offset":111131,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505699 Key: Timestamp: 2025-12-06 16:06:47.755 Headers: empty

{"@version":"1","event":{"hash":"cb994cc447eec71e68dfed4e0598d76b0e83338ee16047429608666600e5f8ad"},"ecs":{"version":"1.6.0"},"message":"1765037203.851086\tCZO56cNgePT4MDmTj\t172.30.1.35\t58538\t172.30.1.254\t53\tudp\t37618\t1.945653\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t265.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:47.576Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":111311},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505700 Key: Timestamp: 2025-12-06 16:06:47.755 Headers: empty

{"@version":"1","event":{"hash":"36cac95a9cc3fe92c4ccb8373f13d96fb737c061d6218f7fccb6386463241470"},"ecs":{"version":"1.6.0"},"message":"1765037205.679829\tCXvtOv4jEaSZ8qQvM2\t172.30.1.12\t43510\t172.30.1.254\t53\tudp\t22688\t0.002859\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:47.576Z","host":{"name":"f6b540842a86"},"log":{"offset":111483,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505701 Key: Timestamp: 2025-12-06 16:06:47.755 Headers: empty

{"@version":"1","event":{"hash":"f3faee90bfd8e6b137c2ba328c431ea493bfe8c6326bab0ee22df450bf7248e6"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037194.569730\tCs3PkZ2Ge970qgucq2\t172.30.1.12\t51150\t172.30.1.254\t53\tudp\tdns\t0.002904\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:46.650Z","host":{"name":"f6b540842a86"},"log":{"offset":110801,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505702 Key: Timestamp: 2025-12-06 16:06:47.755 Headers: empty

{"@version":"1","event":{"hash":"f26ae01e64be68e09be04192911717d955c8beeac1b89f85cb16d5bab9f244ea"},"ecs":{"version":"1.6.0"},"message":"1765037206.689802\tCEJPRt3jRxICUnyz\t172.30.1.12\t55034\t172.30.1.254\t53\tudp\t22689\t0.002788\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:47.576Z","host":{"name":"f6b540842a86"},"log":{"offset":111663,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505703 Key: Timestamp: 2025-12-06 16:06:48.755 Headers: empty

{"@version":"1","event":{"hash":"3ca7c9e321b4de3045239d6ce39ebe45027e58269a55add178de3f0ff00d7acb"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037195.579700\tCOj25uGo22fGyhSi8\t172.30.1.12\t48805\t172.30.1.254\t53\tudp\tdns\t0.003126\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:47.650Z","host":{"name":"f6b540842a86"},"log":{"offset":110930,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505704 Key: Timestamp: 2025-12-06 16:06:49.757 Headers: empty

{"@version":"1","event":{"hash":"c35a9ea67299b5cf47596cd29bc09d41da73bfbeb061a65476d108b3893384a2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037196.589683\tCK1Lh03DwaUfXLEwn8\t172.30.1.12\t59700\t172.30.1.254\t53\tudp\tdns\t0.003112\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:48.652Z","host":{"name":"f6b540842a86"},"log":{"offset":111058,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505705 Key: Timestamp: 2025-12-06 16:06:49.757 Headers: empty

{"@version":"1","event":{"hash":"4dfd5ac709081829b39b6e1c45f5a574ad543c63836fe330a91aa6ba522d0365"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037197.599757\tClT9Rj2eX6XPModMwi\t172.30.1.12\t39599\t172.30.1.254\t53\tudp\tdns\t0.002874\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:48.652Z","host":{"name":"f6b540842a86"},"log":{"offset":111187,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505706 Key: Timestamp: 2025-12-06 16:06:50.756 Headers: empty

{"@version":"1","event":{"hash":"46c171be0d71c9b1560923a9251926238ed62bf26d712949fb4e8e1753604184"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037198.609707\tCvJpRr4jqOfFxHbyMi\t172.30.1.12\t57566\t172.30.1.254\t53\tudp\tdns\t0.003314\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:49.652Z","host":{"name":"f6b540842a86"},"log":{"offset":111316,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505707 Key: Timestamp: 2025-12-06 16:06:50.756 Headers: empty

{"@version":"1","event":{"hash":"cd9928fcc14d09bb7b01d61229757e856203992e28efbb7b7e4f7b0d99e80e88"},"ecs":{"version":"1.6.0"},"message":"1765037207.699796\tCklPBP2DH3XuJkCGqd\t172.30.1.12\t35009\t172.30.1.254\t53\tudp\t22690\t0.003190\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.576Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":111841},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505708 Key: Timestamp: 2025-12-06 16:06:50.756 Headers: empty

{"@version":"1","event":{"hash":"432db47ef57666955b04da5ee324c8829756e347ca1ad62b273eaf9d83c9fcaf"},"ecs":{"version":"1.6.0"},"message":"1765037208.709823\tCmF71y3Matmn0PNE4a\t172.30.1.12\t59054\t172.30.1.254\t53\tudp\t22691\t0.003151\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.576Z","host":{"name":"f6b540842a86"},"log":{"offset":112021,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505709 Key: Timestamp: 2025-12-06 16:06:50.756 Headers: empty

{"@version":"1","event":{"hash":"875525eb5ea7d685596a98846c1773abd6b827075ca677884ec753331fba74eb"},"ecs":{"version":"1.6.0"},"message":"1765037208.827693\tCE7VAc4FeVg8AD1RZh\t172.30.1.35\t61636\t8.8.8.8\t53\tudp\t16345\t0.029465\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2859.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.576Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":112201},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505710 Key: Timestamp: 2025-12-06 16:06:50.756 Headers: empty

{"@version":"1","event":{"hash":"e24a656a95af6434eb13bc68955f48aa5b5a9e42b23ab7f148be59acc567862f"},"ecs":{"version":"1.6.0"},"message":"1765037209.719804\tCO4nmA1gGhucwo4RKa\t172.30.1.12\t58384\t172.30.1.254\t53\tudp\t22692\t0.003523\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.576Z","host":{"name":"f6b540842a86"},"log":{"offset":112370,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505711 Key: Timestamp: 2025-12-06 16:06:51.756 Headers: empty

{"@version":"1","event":{"hash":"ead4f7d1150b131c0c22ba4ce9a7870efeab9fbb57b39593f459b8d1710cb6cf"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037188.791170\tCBUtcY15d2ENIcilu9\t172.30.1.35\t63502\t172.30.1.254\t53\tudp\tdns\t2.005566\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.653Z","host":{"name":"f6b540842a86"},"log":{"offset":111445,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505712 Key: Timestamp: 2025-12-06 16:06:51.756 Headers: empty

{"@version":"1","event":{"hash":"d7a65f1c482f430a23e86398953350377644508bce0726f1b1ac66d1148501b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037198.834067\tCrleSc4Tijm0bb399k\t172.30.1.35\t61609\t8.8.8.8\t53\tudp\tdns\t0.027739\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:50.653Z","host":{"name":"f6b540842a86"},"log":{"offset":111576,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505713 Key: Timestamp: 2025-12-06 16:06:52.763 Headers: empty

{"@version":"1","event":{"hash":"6272af572d59733dcf26265455eed203e79c78673b3574a0239703cf613c80c8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037200.630129\tCRFzIe3SEnoE8sMSvd\t172.30.1.12\t37535\t172.30.1.254\t53\tudp\tdns\t0.003291\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:51.653Z","host":{"name":"f6b540842a86"},"log":{"offset":111831,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505714 Key: Timestamp: 2025-12-06 16:06:52.763 Headers: empty

{"@version":"1","event":{"hash":"b359d843b769c8522c583d35421337ea174dde916debe2eba0c2ff4c51109233"},"ecs":{"version":"1.6.0"},"message":"1765037206.024260\tCjer0n4Y2mEyq9YkAh\t202.46.62.96\t58144\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tFb6jo71yhkTOuG907a,FuFzCt7I2hjYG6ioi\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:52.200Z","host":{"name":"f6b540842a86"},"log":{"offset":8794,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505715 Key: Timestamp: 2025-12-06 16:06:52.763 Headers: empty

{"@version":"1","event":{"hash":"2b43445d91ead3a4d8d65475f2740ecb5063792e0c9ae3920b638db276523d23"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037199.619753\tCSM1Hg3MDuV1OpdKsj\t172.30.1.12\t34164\t172.30.1.254\t53\tudp\tdns\t0.002813\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:51.653Z","host":{"name":"f6b540842a86"},"log":{"offset":111702,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505716 Key: Timestamp: 2025-12-06 16:06:52.763 Headers: empty

{"@version":"1","event":{"hash":"a914eb883d7911d40e3df94048a495fed6d28b64708e512bff5781429321e226"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037205.781673\tCDpmZaLBFcJQukkP2\t202.46.62.58\t37402\t172.30.1.2\t80\ttcp\thttp\t0.161799\t312\t512\tSF\tF\tT\t0\tShADadfF\t6\t632\t5\t780\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:51.653Z","host":{"name":"f6b540842a86"},"log":{"offset":111960,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505717 Key: Timestamp: 2025-12-06 16:06:54.680 Headers: empty

{"@version":"1","event":{"hash":"99cd01fcac9b045e75b1ca5c1f57a22048bc8ac2b64caf4dea7a164501fc4e5c"},"ecs":{"version":"1.6.0"},"message":"1765037208.801184\tCEk0ODwRyA5JPRbdi\t172.30.1.35\t61636\t172.30.1.254\t53\tudp\t16345\t1.995538\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t835.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:53.577Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":112550},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505718 Key: Timestamp: 2025-12-06 16:06:54.680 Headers: empty

{"@version":"1","event":{"hash":"2604913b07f74142f3a11fa21070598d669635e61083781e7c36d6d0e4b340ec"},"ecs":{"version":"1.6.0"},"message":"1765037205.861713\tCDpmZaLBFcJQukkP2\t202.46.62.58\t37402\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=srgw&smid=15600&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t266\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFWigxW3uRElVW03Kyh\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.189Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/http.log"},"offset":6385},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505719 Key: Timestamp: 2025-12-06 16:06:54.680 Headers: empty

{"@version":"1","event":{"hash":"c74c75710ebcdcc8cab43c10e4d3c21db04fbeb5ea96a7a48ad442700c3b6d8f"},"ecs":{"version":"1.6.0"},"message":"1765037211.814934\tCe7qX61Nqtc9ld2pB2\t172.30.1.12\t44270\t172.30.1.254\t53\tudp\t22694\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:53.577Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":112894},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505720 Key: Timestamp: 2025-12-06 16:06:54.680 Headers: empty

{"@version":"1","event":{"hash":"692a2c0641b8fedbf4c02607d003d4e8e4319638bc775ff409f29f969e9eb806"},"ecs":{"version":"1.6.0"},"message":"1765037210.766009\tCL29jLqlqO66MnXZ4\t172.30.1.12\t41246\t172.30.1.254\t53\tudp\t22693\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:53.577Z","host":{"name":"f6b540842a86"},"log":{"offset":112722,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505721 Key: Timestamp: 2025-12-06 16:06:55.681 Headers: empty

{"@version":"1","event":{"hash":"a57fb089babdb52da1087f3237296c6b7770888e4f218e4a6b32f0019b390318"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037205.945254\tCjer0n4Y2mEyq9YkAh\t202.46.62.96\t58144\t172.30.1.2\t443\ttcp\tssl\t0.827721\t1083\t19037\tRSTO\tF\tT\t0\tShADadfR\t21\t2171\t19\t20033\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.654Z","host":{"name":"f6b540842a86"},"log":{"offset":112227,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505722 Key: Timestamp: 2025-12-06 16:06:55.681 Headers: empty

{"@version":"1","event":{"hash":"6feadced203661e87acace18da0ce7bcdbf19537d14d581907310648f914197a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037202.649871\tCXFRC44aR3Q2OretRh\t172.30.1.12\t60367\t172.30.1.254\t53\tudp\tdns\t0.002676\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.654Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":112376},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505723 Key: Timestamp: 2025-12-06 16:06:55.681 Headers: empty

{"@version":"1","event":{"hash":"410efb39dae241d193e54e7ca2bd8676df089ad68f96863db7b927e703b3c134"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037203.828435\tCCMPDd4hkmLG83j0xj\t172.30.1.35\t58538\t8.8.8.8\t53\tudp\tdns\t0.027400\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.654Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":112505},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505724 Key: Timestamp: 2025-12-06 16:06:55.681 Headers: empty

{"@version":"1","event":{"hash":"872427420c01579afa68486ae7803366b1240e2810e1538fd705859987c87f27"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037201.639845\tCnx3xs3uGu3n4N8cwa\t172.30.1.12\t49994\t172.30.1.254\t53\tudp\tdns\t0.002902\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.654Z","host":{"name":"f6b540842a86"},"log":{"offset":112098,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505725 Key: Timestamp: 2025-12-06 16:06:55.681 Headers: empty

{"@version":"1","event":{"hash":"36404ed6a42d8fd7a380556b5cb32413f3fd1d76694b4f51cb5d8ff06d7e3cb0"},"ecs":{"version":"1.6.0"},"message":"1765037212.778494\tCAYbzuUtz5E0Xnpod\t172.30.1.12\t47408\t172.30.1.254\t53\tudp\t22695\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:54.577Z","host":{"name":"f6b540842a86"},"log":{"offset":113067,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505726 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"ce916784050d71e2bb947f0e09e335d32180984fbbeaf1b540695c8bb41676cd"},"ecs":{"version":"1.6.0"},"message":"1765037215.779937\tC3aXvj4UgdzFLWwBud\t172.30.1.12\t37758\t172.30.1.254\t53\tudp\t22698\t0.003107\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:56.579Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":113760},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505727 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"ad4054f230d97fefe8cea89231dec32aa7e9f5e622f0e854cd486645ead23d45"},"ecs":{"version":"1.6.0"},"message":"1765037213.792777\tCS2s8U1nNsbHRP4hf8\t172.30.1.12\t32907\t172.30.1.254\t53\tudp\t22696\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.579Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":113239},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505728 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"107331543cc81cb6bbb5eef1c561dae70e8e5b088c18df62d6a814dd1530051b"},"ecs":{"version":"1.6.0"},"message":"1765037213.834427\tCBzIMedPuEg0sT5c1\t172.30.1.35\t64108\t8.8.8.8\t53\tudp\t33140\t0.029884\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2854.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.579Z","host":{"name":"f6b540842a86"},"log":{"offset":113412,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505729 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"57ec8a9b5e4a470c78effb875310c21c8bee50529416a9ac5cb16cf930cf35a9"},"ecs":{"version":"1.6.0"},"message":"1765037214.770010\tCHima13mmXd5GeqgXe\t172.30.1.12\t60278\t172.30.1.254\t53\tudp\t22697\t0.003687\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.579Z","host":{"name":"f6b540842a86"},"log":{"offset":113580,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505730 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"132bf0c85c7e15bda84a6bb6fb4cdceab55854f5d163c37c652bdfc34c979a18"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037203.660137\tC0dtU834qI8Llpgtj3\t172.30.1.12\t49815\t172.30.1.254\t53\tudp\tdns\t0.002628\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.655Z","host":{"name":"f6b540842a86"},"log":{"offset":112631,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505731 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"c4e1529aba63f7c180e815ed87cd1ce9a99d7439c3f0220babacf61f97551c67"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765037193.785003\tCcXUa63bCSZfBZJAdb\t172.30.1.35\t54201\t172.30.1.254\t53\tudp\tdns\t2.011884\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.655Z","host":{"name":"f6b540842a86"},"log":{"offset":112760,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505732 Key: Timestamp: 2025-12-06 16:06:56.683 Headers: empty

{"@version":"1","event":{"hash":"ab91ecfe98060c3fc1e51c70f86785cbf047827d1c7ebd9c24ba90ea288fc996"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037204.669792\tCyNPUw3iZm1eyZfww4\t172.30.1.12\t55746\t172.30.1.254\t53\tudp\tdns\t0.002732\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:55.655Z","host":{"name":"f6b540842a86"},"log":{"offset":112891,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505733 Key: Timestamp: 2025-12-06 16:06:57.763 Headers: empty

{"@version":"1","event":{"hash":"d452b9df0a27db6a2cad085127f1b7a0b59a9d5fb3a114cfff72c2c77e7a0cad"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037210.227774\tCPntDD1GUieYPOPaYj\t172.30.1.2\t43058\t172.30.4.139\t1514\ttcp\t-\t2.999018\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:56.658Z","host":{"name":"f6b540842a86"},"log":{"offset":113020,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505734 Key: Timestamp: 2025-12-06 16:06:57.763 Headers: empty

{"@version":"1","event":{"hash":"b2841c253b215e1abd9104182eb1a8dcc3841ba18fd597db3fb93b58f404a9e1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037205.679829\tCXvtOv4jEaSZ8qQvM2\t172.30.1.12\t43510\t172.30.1.254\t53\tudp\tdns\t0.002859\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:56.659Z","host":{"name":"f6b540842a86"},"log":{"offset":113145,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505735 Key: Timestamp: 2025-12-06 16:06:57.763 Headers: empty

{"@version":"1","event":{"hash":"de3324df09ff05c5c0fe595bddc12f57c26ebe5c45b9e62d270ba9d0ac4eb23a"},"ecs":{"version":"1.6.0"},"message":"1765037206.033276\tFb6jo71yhkTOuG907a\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:57.224Z","host":{"name":"f6b540842a86"},"log":{"offset":8648,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505736 Key: Timestamp: 2025-12-06 16:06:57.763 Headers: empty

{"@version":"1","event":{"hash":"46a97d8162dcc1007afca8157a29be88dc0e5fc9dc315b0be8ff02e75ac74060"},"ecs":{"version":"1.6.0"},"message":"1765037213.794742\tCrSLFq2VLlQDs0q8vl\t172.30.1.35\t64108\t172.30.1.254\t53\tudp\t33140\t2.012051\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t830.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:57.580Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":113940},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505737 Key: Timestamp: 2025-12-06 16:06:57.763 Headers: empty

{"@version":"1","event":{"hash":"9786594f4a634a1d2bbb64248113accd1b208384d9feba8e48edd7f3ba2e13ca"},"ecs":{"version":"1.6.0"},"message":"1765037216.790154\tCxbdzr1INqt1FmE0cj\t172.30.1.12\t60517\t172.30.1.254\t53\tudp\t22699\t0.002695\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:06:57.580Z","host":{"name":"f6b540842a86"},"log":{"offset":114113,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505738 Key: Timestamp: 2025-12-06 16:07:23.806 Headers: empty

{"@version":"1","event":{"hash":"865ebecabb5c2b98e64450d5577ae3cd9ac31fe14bbefd3817c847c515bd38f8"},"ecs":{"version":"1.6.0"},"message":"1765037242.040142\tCFXnnm44eY4v53RNaf\t172.30.1.12\t35090\t172.30.1.254\t53\tudp\t22724\t0.002857\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:23.595Z","host":{"name":"f6b540842a86"},"log":{"offset":120443,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505739 Key: Timestamp: 2025-12-06 16:07:24.806 Headers: empty

{"@version":"1","event":{"hash":"0e33845589da7622285089814495431a8140fe2891df3736c89ac19a9e3e8f20"},"ecs":{"version":"1.6.0"},"message":"1765037243.066199\tCTutea13uMrr37xCGa\t172.30.1.12\t45072\t172.30.1.254\t53\tudp\t22725\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:24.595Z","host":{"name":"f6b540842a86"},"log":{"offset":120623,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505740 Key: Timestamp: 2025-12-06 16:07:24.806 Headers: empty

{"@version":"1","event":{"hash":"050dab829f60a48e60f8907db4e8f3163b619fdd30e0a83c35811db6cb7377a0"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037231.940755\tCN1gf74DQA9lh2TQyj\t172.30.1.12\t35336\t172.30.1.254\t53\tudp\tdns\t0.001979\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:23.703Z","host":{"name":"f6b540842a86"},"log":{"offset":120159,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505741 Key: Timestamp: 2025-12-06 16:07:24.806 Headers: empty

{"@version":"1","event":{"hash":"60c334275e8e248c2e9c0befc5185d79fd254ebd2a08091cd8dddf3be4939490"},"ecs":{"version":"1.6.0"},"message":"1765037243.830073\tCKnizy10Za8ekcIdf\t172.30.1.35\t53492\t8.8.8.8\t53\tudp\t12955\t0.027448\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1391.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:24.596Z","host":{"name":"f6b540842a86"},"log":{"offset":120796,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505742 Key: Timestamp: 2025-12-06 16:07:25.808 Headers: empty

{"@version":"1","event":{"hash":"9d1b83ffb7467e1107d38d350606f2c39b7c69f49d1f6e92cbbceb828bbea2a2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037232.951571\tCnBwLY1a7zcI8PgCqf\t172.30.1.12\t38214\t172.30.1.254\t53\tudp\tdns\t0.002187\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:24.704Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":120288},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505743 Key: Timestamp: 2025-12-06 16:07:25.808 Headers: empty

{"@version":"1","event":{"hash":"dcdee9f31f31ff1f6ce0c1dda5f7492839d4d5323a7987556ce2a9eb5e47693a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037237.954746\tCbpOJU3t3f9jXoRttc\t172.30.1.63\t54306\t172.30.2.171\t5044\ttcp\t-\t2.048058\t0\t0\tS0\tT\tT\t0\tS\t2\t120\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:24.704Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":120417},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505744 Key: Timestamp: 2025-12-06 16:07:25.808 Headers: empty

{"@version":"1","event":{"hash":"8183837be428fffcca07ff54da6a25d7c7a338b36496627b899a8e61dccef887"},"ecs":{"version":"1.6.0"},"message":"1765037244.060166\tCVb05D2KF3S799nhJ9\t172.30.1.12\t36363\t172.30.1.254\t53\tudp\t22726\t0.003462\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:25.596Z","host":{"name":"f6b540842a86"},"log":{"offset":120964,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505745 Key: Timestamp: 2025-12-06 16:07:26.807 Headers: empty

{"@version":"1","event":{"hash":"ad845c14cfbd287e4e29da112347e4cd32de4a0ff8660fb7e2661cf2886b627b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765037233.843668\tC0lD0Y7aBkkZJQ2B\t172.30.1.35\t55594\t8.8.8.8\t53\tudp\tdns\t0.021180\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:25.704Z","host":{"name":"f6b540842a86"},"log":{"offset":120796,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505746 Key: Timestamp: 2025-12-06 16:07:26.807 Headers: empty

{"@version":"1","event":{"hash":"860cbee91967dbfb091846780790affe6f751b4815d95300a98190a958ad8657"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765037223.794942\tCngMGA4PnGlTIWFXM6\t172.30.1.35\t50060\t172.30.1.254\t53\tudp\tdns\t2.011933\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:25.704Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":120920},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505747 Key: Timestamp: 2025-12-06 16:07:26.807 Headers: empty

{"@version":"1","event":{"hash":"4f1393c95f8e276b79f97745a88fe8fb6421e66558ab7ec4d1a3eaeed9e9089a"},"ecs":{"version":"1.6.0"},"message":"1765037245.084842\tCSv8bN3dmG9zGLyX5i\t172.30.1.12\t39254\t172.30.1.254\t53\tudp\t22727\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:26.596Z","host":{"name":"f6b540842a86"},"log":{"offset":121144,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 1505748 Key: Timestamp: 2025-12-06 16:07:26.807 Headers: empty

{"@version":"1","event":{"hash":"c2b312d20b4ff0cc8509d554b043cd4d33611f08b383590a125d06c8d0a8ec93"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765037233.960059\tCdORjO1qUEHDF8nSu\t172.30.1.12\t41178\t172.30.1.254\t53\tudp\tdns\t0.006156\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-06T16:07:25.704Z","host":{"name":"f6b540842a86"},"log":{"offset":120543,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network