Kafdrop: Topic: logstash-local-network: Messages

Offset: 647736 Key: Timestamp: 2025-12-10 03:31:20.248 Headers: empty

{"@version":"1","event":{"hash":"83573450545fcfe96c3fac85659f6a12b27268ccc5f577e3d66fc46d7e75e565"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337468.168852\tC7YwfI2jBUFos38Drg\t172.30.1.35\t50186\t8.8.8.8\t53\tudp\tdns\t0.027973\t28\t60\tSF\tT\tF\t0\tDd\t1\t56\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:19.594Z","host":{"name":"f6b540842a86"},"log":{"offset":486958,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647737 Key: Timestamp: 2025-12-10 03:31:20.248 Headers: empty

{"@version":"1","event":{"hash":"7cc36d06de1a1bf0db6ccff69c6b0ef5b050c0a44b6ee02e90c8975d0c51673f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337472.560022\tCqgcFC1tcHbFdT4S7i\t172.30.1.2\t52244\t172.30.4.139\t1514\ttcp\t-\t2.999045\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:19.594Z","host":{"name":"f6b540842a86"},"log":{"offset":486833,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647738 Key: Timestamp: 2025-12-10 03:31:20.248 Headers: empty

{"@version":"1","event":{"hash":"dc2ea5f60a40d1936f4da0756512386e6c646ba9d150d59d395312ea0a7ad1a9"},"ecs":{"version":"1.6.0"},"message":"1765337478.144938\tCKbAZH1ptQgnwV4nje\t172.30.1.12\t40315\t8.8.8.8\t53\tudp\t55146\t0.029540\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t140.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:19.143Z","host":{"name":"f6b540842a86"},"log":{"offset":490125,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647739 Key: Timestamp: 2025-12-10 03:31:20.249 Headers: empty

{"@version":"1","event":{"hash":"441b132465ed7e96ea6d10d64a221f9e13adc7f1b72146e573d8c86395115f57"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337468.168435\tCo0kD24zN5w9OQEuv5\t172.30.1.35\t56001\t8.8.8.8\t53\tudp\tdns\t0.026738\t28\t104\tSF\tT\tF\t0\tDd\t1\t56\t1\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:19.594Z","host":{"name":"f6b540842a86"},"log":{"offset":487082,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647740 Key: Timestamp: 2025-12-10 03:31:21.251 Headers: empty

{"@version":"1","event":{"hash":"4d0b36e1a88c4d64019609d7752810c7ffc1ef5511a6acc9c9109290c37cbb4f"},"ecs":{"version":"1.6.0"},"message":"1765337479.184950\tCtVKQv1SIYZ730qzu4\t172.30.1.12\t50022\t8.8.8.8\t53\tudp\t55147\t0.027410\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t139.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:20.146Z","host":{"name":"f6b540842a86"},"log":{"offset":490300,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647741 Key: Timestamp: 2025-12-10 03:31:21.251 Headers: empty

{"@version":"1","event":{"hash":"644d52fe2df9704b45d1188ac42ff950e0f2899d1cd532ce85ada887e8ed02c2"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337470.071409\tC2Pi6338apgQyNTuqe\t202.46.62.68\t41399\t172.30.1.2\t443\ttcp\t-\t4.333269\t1083\t19037\tRSTO\tF\tT\t517\tShAaGDdtfR\t23\t2331\t25\t26057\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:20.595Z","host":{"name":"f6b540842a86"},"log":{"offset":487208,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647742 Key: Timestamp: 2025-12-10 03:31:21.251 Headers: empty

{"@version":"1","event":{"hash":"2ece0ef98af520402e3fbbaf378e080ea2a92f4fbbc8ce031b7a1dd33a81ac26"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337468.775064\tCel3OP1bw3Sqx6CQz6\t172.30.1.12\t43909\t8.8.8.8\t53\tudp\tdns\t0.030352\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:20.595Z","host":{"name":"f6b540842a86"},"log":{"offset":487359,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647743 Key: Timestamp: 2025-12-10 03:31:22.252 Headers: empty

{"@version":"1","event":{"hash":"427e40b14f0efc9e905560c8f67a43a1d75c55f432657b20913e38ae24e784e8"},"ecs":{"version":"1.6.0"},"message":"1765337480.214974\tCth7D31uayUNsx08X5\t172.30.1.12\t35802\t8.8.8.8\t53\tudp\t55148\t0.030137\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t52.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:21.148Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":490475},"tags":["beats_input_codec_plain_applied"]}

Offset: 647744 Key: Timestamp: 2025-12-10 03:31:22.252 Headers: empty

{"@version":"1","event":{"hash":"0ce85c90b2c37f105f1e7fd9d8dcae1306a9de6b869f82020bdf855cd9bd26d2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337469.814911\tC7EUY71AfFyU0XKl44\t172.30.1.12\t33936\t8.8.8.8\t53\tudp\tdns\t0.029389\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:21.597Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":487483},"tags":["beats_input_codec_plain_applied"]}

Offset: 647745 Key: Timestamp: 2025-12-10 03:31:23.252 Headers: empty

{"@version":"1","event":{"hash":"6f17c9c379dccc6d0a7fbf39571936d47f3c4e998d8632ded7c07dad3fb85ed0"},"ecs":{"version":"1.6.0"},"message":"1765337481.593536\tCvyD5G4fmd9Ytm4Gbb\t172.30.1.35\t60621\t8.8.8.8\t53\tudp\t234\t0.027736\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t863.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:22.148Z","host":{"name":"f6b540842a86"},"log":{"offset":490649,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647746 Key: Timestamp: 2025-12-10 03:31:23.252 Headers: empty

{"@version":"1","event":{"hash":"e2253dbfe8bc13a4c38e1650ad61c6812ff261133610aa4af292e9ae4e193ed2"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337470.885921\tCc0Ynw3bgqWZ34W2Nf\t172.30.1.12\t46976\t8.8.8.8\t53\tudp\tdns\t0.030230\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:22.597Z","host":{"name":"f6b540842a86"},"log":{"offset":487607,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647747 Key: Timestamp: 2025-12-10 03:31:23.252 Headers: empty

{"@version":"1","event":{"hash":"a713aaaf4dfc98f0b974a3de4f9059372d1c91e94a57f413578624bdb768b1f0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337470.855004\tChfB3D3TA3y42i5Mcf\t172.30.1.12\t40474\t8.8.8.8\t53\tudp\tdns\t0.029384\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:22.597Z","host":{"name":"f6b540842a86"},"log":{"offset":487731,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647748 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"a5c0159cb40e2d72656bd5f2c796f5eacea8755a19e308ed32d010de15c0a600"},"ecs":{"version":"1.6.0"},"message":"1765337481.255046\tC7IlVS3cDEjQrPORQ5\t172.30.1.12\t51062\t8.8.8.8\t53\tudp\t55149\t0.029618\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t51.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.149Z","host":{"name":"f6b540842a86"},"log":{"offset":490815,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647749 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"e9978cee3b6382751bfd34eae78e97f1dc241dd516fb0fdd9234fbb2dcc8ba80"},"ecs":{"version":"1.6.0"},"message":"1765337482.295460\tC3qwbk4mOSfqv14Yz4\t172.30.1.12\t47562\t8.8.8.8\t53\tudp\t55150\t0.028375\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t45.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.149Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":490989},"tags":["beats_input_codec_plain_applied"]}

Offset: 647750 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"0d42b26266f361775ed38c5c4b4cc4d96ad4b08efff770ad463fe02f3e028d57"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337471.578469\tCd7a1Exalt0l5etnj\t172.30.1.35\t58362\t8.8.8.8\t53\tudp\tdns\t0.028565\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.598Z","host":{"name":"f6b540842a86"},"log":{"offset":487855,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647751 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"ed05230e6f887ccf713b0a78bf76940d6b10c9fd85b028f60cdd6a90b1f81298"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337471.924973\tCtTjQ1433BasMgJVSe\t172.30.1.12\t37954\t8.8.8.8\t53\tudp\tdns\t0.028067\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.598Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":487980},"tags":["beats_input_codec_plain_applied"]}

Offset: 647752 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"371a808d1ee9f894087a4bf0ce77dcef866c6539e9d7cc93fce00d86b933f21e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337366.773915\tCDYRmG4fL3VoONb1Ak\t172.30.1.35\t52160\t40.126.16.167\t443\ttcp\tssl\t110.076930\t15135\t47674\tSF\tT\tF\t1\tShADdatFgf\t32\t16475\t42\t49366\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.598Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":488104},"tags":["beats_input_codec_plain_applied"]}

Offset: 647753 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"8a6406094097e6f0ebe9a6f516f5a0cdc319002190cbeef30a9b1c29fc59bd9b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337351.989256\tCGzMbf1TQUdI4mdxA\t172.30.1.35\t52156\t72.154.7.98\t443\ttcp\tssl\t124.622065\t1382\t3059\tSF\tT\tF\t1\tShADdaFgfr\t14\t1954\t12\t3551\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:23.598Z","host":{"name":"f6b540842a86"},"log":{"offset":488259,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647754 Key: Timestamp: 2025-12-10 03:31:24.253 Headers: empty

{"@version":"1","event":{"hash":"b09b6a31f398e0d80cac95a7ecb100ec293cc0c4ca6e01311cbae14aca341e68"},"ecs":{"version":"1.6.0"},"message":"1765337481.553050\tCLyg7HfuuTZ8wcK55\t172.30.1.35\t60621\t172.30.1.254\t53\tudp\t234\t1.216738\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2314.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:24.149Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":491163},"tags":["beats_input_codec_plain_applied"]}

Offset: 647755 Key: Timestamp: 2025-12-10 03:31:25.716 Headers: empty

{"@version":"1","event":{"hash":"5e3e4b1fdc41f40ef5670a7bd823b7a907c2f22c8e2d7e4ef6fad5ec4e809c6b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337472.954909\tCc5AA04kI7Jhdb4ug4\t172.30.1.12\t59807\t8.8.8.8\t53\tudp\tdns\t0.028471\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:24.598Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":488407},"tags":["beats_input_codec_plain_applied"]}

Offset: 647756 Key: Timestamp: 2025-12-10 03:31:25.716 Headers: empty

{"@version":"1","event":{"hash":"b29907131a60e4dde14252216275743d364cf9370a6a98cdb679a109438d599b"},"ecs":{"version":"1.6.0"},"message":"1765337483.339884\tCU3n2L2G7MFWsYS8K3\t172.30.1.12\t59798\t8.8.8.8\t53\tudp\t55151\t0.028380\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t135.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:25.149Z","host":{"name":"f6b540842a86"},"log":{"offset":491334,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647757 Key: Timestamp: 2025-12-10 03:31:25.716 Headers: empty

{"@version":"1","event":{"hash":"14360c0b17754bd23d607c244d132b702ccc73621f411655db08c6409a6b772a"},"ecs":{"version":"1.6.0"},"message":"1765337474.004286\tC2T4RT1WpqF6XLBC74\t172.30.1.35\t5353\t224.0.0.251\t5353\tudp\t0\t-\t_sleep-proxy._udp.local\t1\tC_INTERNET\t12\tPTR\t-\t-\tF\tF\tF\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:25.149Z","host":{"name":"f6b540842a86"},"log":{"offset":491509,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647758 Key: Timestamp: 2025-12-10 03:31:26.717 Headers: empty

{"@version":"1","event":{"hash":"26e8b82e8d3bd12dcfd5d59478f7429b468c113342a1d4722be706df62d01b01"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337474.004286\tC2T4RT1WpqF6XLBC74\t172.30.1.35\t5353\t224.0.0.251\t5353\tudp\tdns\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t129\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:25.607Z","host":{"name":"f6b540842a86"},"log":{"offset":488531,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647759 Key: Timestamp: 2025-12-10 03:31:26.717 Headers: empty

{"@version":"1","event":{"hash":"0701ac7f9fe07d29a6e5753f864894d2be4289e97b85864bba9f03af706c0449"},"ecs":{"version":"1.6.0"},"message":"1765337484.400080\tC0REKh41E0SGsnJ7N2\t172.30.1.12\t37577\t8.8.8.8\t53\tudp\t55152\t0.002571\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t134.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:26.150Z","host":{"name":"f6b540842a86"},"log":{"offset":491652,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647760 Key: Timestamp: 2025-12-10 03:31:26.717 Headers: empty

{"@version":"1","event":{"hash":"de04d750e51923032a0b7e674ac6b0a50cabeb0ea3df7789021e21856b1973c3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337474.005119\tCEBxp76s1HLEz4m1f\t172.30.1.12\t54919\t8.8.8.8\t53\tudp\tdns\t0.029328\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:31:25.614Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":488650},"tags":["beats_input_codec_plain_applied"]}

Offset: 647761 Key: Timestamp: 2025-12-10 03:33:17.334 Headers: empty

{"@version":"1","event":{"hash":"6b30a361a05bad744fb9ff137810ca050411b1d76a6483978902b58200d4eab9"},"ecs":{"version":"1.6.0"},"message":"1765337595.432266\tCypXB71ffPk7s4ESg2\t172.30.1.12\t56494\t8.8.8.8\t53\tudp\t55262\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t237.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:16.231Z","host":{"name":"f6b540842a86"},"log":{"offset":517706,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647762 Key: Timestamp: 2025-12-10 03:33:17.334 Headers: empty

{"@version":"1","event":{"hash":"46d1a2851f9185a11cb518423c0244876c388547edb82eec7635098aacd5d000"},"ecs":{"version":"1.6.0"},"message":"1765337595.173649\tCrHQDa328KzSp3R4qd\t172.30.1.222\t65222\t8.8.8.8\t53\ttcp\t41111\t-\tdns.google\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:16.232Z","host":{"name":"f6b540842a86"},"log":{"offset":518048,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647763 Key: Timestamp: 2025-12-10 03:33:17.334 Headers: empty

{"@version":"1","event":{"hash":"cc67cd76380cdbace53259bcee2e55ded058cca6e0e0b590cac4dcb38061137d"},"ecs":{"version":"1.6.0"},"message":"1765337595.172344\tCJgi0z2v7b5YbHK4Fh\t172.30.1.222\t65221\t8.8.8.8\t53\ttcp\t38149\t0.028279\tdns.google\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t8.8.4.4,8.8.8.8\t216.000000,216.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:16.231Z","host":{"name":"f6b540842a86"},"log":{"offset":517874,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647764 Key: Timestamp: 2025-12-10 03:33:18.337 Headers: empty

{"@version":"1","event":{"hash":"027b85c21adeca5d96b06d88a96b6751dc94fc2888aa546a214b5c990cbc460d"},"ecs":{"version":"1.6.0"},"message":"1765337596.396145\tCU8bQp3SJn1r0f5Rb1\t172.30.1.12\t46739\t8.8.8.8\t53\tudp\t55263\t0.027525\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t78.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:17.234Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":518189},"tags":["beats_input_codec_plain_applied"]}

Offset: 647765 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"7b21223b605eb179a0d399e46a8add8a644a42e15baae80a3d1f7066d374dbb0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337535.755718\tCv96zF2caQlCX6sTVg\t10.10.10.1\t55086\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.671Z","host":{"name":"f6b540842a86"},"log":{"offset":515918,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647766 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"07cb4795fd69f5c110d7f4225edc3dd71dbf3f92f98def05613615f52d186981"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337586.581201\tCWxG7G1WrWKZBvsBai\t172.30.1.35\t62197\t8.8.8.8\t53\tudp\tdns\t0.028961\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.671Z","host":{"name":"f6b540842a86"},"log":{"offset":516039,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647767 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"6259f8c0631e4ba0502700c8ae6268b440549fe59ea97ede236d6b3c19ff3069"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337586.056148\tCAyEDW3SJWv7wT4mu8\t172.30.1.12\t59198\t8.8.8.8\t53\tudp\tdns\t0.027972\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.671Z","host":{"name":"f6b540842a86"},"log":{"offset":516165,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647768 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"1e41bcdda0a0f128a85a8972bd3b60b91530d601b76aca324256c610686ea3c6"},"ecs":{"version":"1.6.0"},"message":"1765337596.593218\tCdPCqB1iwIqv6BGs2a\t172.30.1.35\t56297\t8.8.8.8\t53\tudp\t30822\t0.029504\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1265.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.235Z","host":{"name":"f6b540842a86"},"log":{"offset":518363,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647769 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"21cd12bdcbb719b3b3936402d19069e0a37ef39a8b2b45a15b9f76119bf11fef"},"ecs":{"version":"1.6.0"},"message":"1765337596.553730\tCZEzmL2Wp3y1wdovfh\t172.30.1.35\t56297\t172.30.1.254\t53\tudp\t30822\t0.450833\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2200.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.235Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":518532},"tags":["beats_input_codec_plain_applied"]}

Offset: 647770 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"15b5622b5e9146f77d919e6cff3f1d9852732efd724beeb9349621de1f4cce29"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337585.016269\tCZ3qMt2hwTJsUdEst\t172.30.1.12\t41106\t8.8.8.8\t53\tudp\tdns\t0.030188\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.671Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":515674},"tags":["beats_input_codec_plain_applied"]}

Offset: 647771 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"fe74cc4cef754158e7c3aedd703f8e23cd19ee16d13221a4131c1242407948f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337535.755643\tCHjqRP1IHRMxKbhu17\t172.30.1.4\t52072\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.671Z","host":{"name":"f6b540842a86"},"log":{"offset":515797,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647772 Key: Timestamp: 2025-12-10 03:33:19.342 Headers: empty

{"@version":"1","event":{"hash":"d388e36c77f3c778f2fb731245626520de2bfb2282491bf3d2e5c110d9b91f80"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337587.086026\tCCRYL94j0bRMqn8wr2\t172.30.1.12\t42467\t8.8.8.8\t53\tudp\tdns\t0.027338\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:18.672Z","host":{"name":"f6b540842a86"},"log":{"offset":516289,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647773 Key: Timestamp: 2025-12-10 03:33:20.342 Headers: empty

{"@version":"1","event":{"hash":"865ac30ebb452723486cc2a3b4db19d28037c631ce7daf4378f4606ade865281"},"ecs":{"version":"1.6.0"},"message":"1765337597.426225\tCbt48j1o5KKgIsVNWk\t172.30.1.12\t60187\t8.8.8.8\t53\tudp\t55264\t0.028436\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t77.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:19.237Z","host":{"name":"f6b540842a86"},"log":{"offset":518706,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647774 Key: Timestamp: 2025-12-10 03:33:20.342 Headers: empty

{"@version":"1","event":{"hash":"1850a1c25d62c1b1a915ebbe8d5b872186f2d02e808d432115725fd22b20921d"},"ecs":{"version":"1.6.0"},"message":"1765337598.466656\tCmmEFY2gcMCIliYDk9\t172.30.1.12\t52785\t8.8.8.8\t53\tudp\t55265\t0.068607\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t234.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:19.239Z","host":{"name":"f6b540842a86"},"log":{"offset":518880,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647775 Key: Timestamp: 2025-12-10 03:33:20.342 Headers: empty

{"@version":"1","event":{"hash":"28917b1d4e6939f22535008d22b865d5ecc62b398bc1b55a28facb24a166d334"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337588.116061\tCDSusFC5RigOJ59Le\t172.30.1.12\t43620\t8.8.8.8\t53\tudp\tdns\t0.028388\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:19.672Z","host":{"name":"f6b540842a86"},"log":{"offset":516413,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647776 Key: Timestamp: 2025-12-10 03:33:21.776 Headers: empty

{"@version":"1","event":{"hash":"e07997619fcb6e523f6482f25b1920c8c161a1f3348f0b2d5d0cbfed24e1725d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337589.156063\tCvdHd21lQaSftmpMvk\t172.30.1.12\t53413\t8.8.8.8\t53\tudp\tdns\t0.027969\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:20.672Z","host":{"name":"f6b540842a86"},"log":{"offset":516669,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647777 Key: Timestamp: 2025-12-10 03:33:21.776 Headers: empty

{"@version":"1","event":{"hash":"b49c7ae987bbc09e63173c725db4a83109976ab72f49177a949ca0f2e6f13c2d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337533.783388\tCMu4ZV2UmF4REgm6Da\t172.30.1.35\t52171\t23.100.109.78\t443\ttcp\t-\t60.021056\t0\t0\tRSTO\tT\tF\t0\tShAR\t3\t132\t1\t52\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:20.672Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":516536},"tags":["beats_input_codec_plain_applied"]}

Offset: 647778 Key: Timestamp: 2025-12-10 03:33:21.776 Headers: empty

{"@version":"1","event":{"hash":"c0671381561030b282195e399aa1c1b84407396ad6b68be6606a33445fe00022"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337533.746939\tCLvjjG4d3GLyDPcrS8\t172.30.1.35\t52170\t23.100.109.78\t443\ttcp\t-\t60.057326\t0\t0\tRSTO\tT\tF\t0\tShAR\t3\t132\t1\t52\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:20.673Z","host":{"name":"f6b540842a86"},"log":{"offset":516793,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647779 Key: Timestamp: 2025-12-10 03:33:22.777 Headers: empty

{"@version":"1","event":{"hash":"4c6337b641e123980d243947f4b675e0b814208db46702a673427c3fb4caa0fb"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337595.630535\tCnWGcY35Z38fuV38Sb\t172.30.1.63\t54232\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:21.673Z","host":{"name":"f6b540842a86"},"log":{"offset":517049,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647780 Key: Timestamp: 2025-12-10 03:33:22.777 Headers: empty

{"@version":"1","event":{"hash":"55cf0c16222fa8e21a6abc3af8e9610e3b95ee0c2847adf44c05f5b3c4430e87"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337595.143916\tCrHQDa328KzSp3R4qd\t172.30.1.222\t65222\t8.8.8.8\t53\ttcp\tdns\t0.091171\t30\t106\tSF\tT\tF\t0\tShADadFf\t6\t282\t5\t318\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:21.673Z","host":{"name":"f6b540842a86"},"log":{"offset":517300,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647781 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"6760270d28bc260eebe640acd8ad8d7aa94bd0dc5ef74e55e3a31a3ea32983f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337595.143686\tCJgi0z2v7b5YbHK4Fh\t172.30.1.222\t65221\t8.8.8.8\t53\ttcp\tdns\t0.085390\t30\t62\tSF\tT\tF\t0\tShADadFf\t6\t282\t5\t274\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:21.673Z","host":{"name":"f6b540842a86"},"log":{"offset":517167,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647782 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"ff004ade671f477cc7d63097106f1f3d5b2a2809289b7c26697d9905a685332c"},"ecs":{"version":"1.6.0"},"message":"1765337599.506325\tCF3Jif2jljqEfESCt8\t172.30.1.12\t56783\t8.8.8.8\t53\tudp\t55266\t0.027913\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t19.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"offset":519055,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647783 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"d1be265c278f56d1352c5bc531f0583f54bcd57448a6af8d4863a88deef2aa2d"},"ecs":{"version":"1.6.0"},"message":"1765337600.581061\tC80vTe3P0vCw2Hwxl9\t172.30.1.12\t49825\t8.8.8.8\t53\tudp\t55267\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t18.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"offset":519229,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647784 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"774f69ee361c60bb0100f8ed6b06c995088fdd5feb2de746411ec05a763f27c8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337591.549083\tCFZ6aG4Wpp0G22Ysld\t172.30.1.35\t52089\t172.30.1.254\t53\tudp\tdns\t0.156382\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.673Z","host":{"name":"f6b540842a86"},"log":{"offset":517683,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647785 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"76d9c0ae7c2a4f4b0e4add396ad147fcc2202c588af6a78ffc7f938f4462a656"},"ecs":{"version":"1.6.0"},"message":"1765337601.021266\tClkGO64g5NTCHb1LHh\t172.30.1.222\t65224\t8.8.8.8\t53\ttcp\t44642\t-\tdns.google\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"offset":519396,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647786 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"13ecf1dc7894b98327f55aa545402712b0d6180dea1714635deae1c4100f97d5"},"ecs":{"version":"1.6.0"},"message":"1765337601.021636\tCqIk9Y2OeKRMAqZ5Yh\t172.30.1.222\t65223\t8.8.8.8\t53\ttcp\t32790\t0.028730\tdns.google\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t8.8.4.4,8.8.8.8\t267.000000,267.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":519537},"tags":["beats_input_codec_plain_applied"]}

Offset: 647787 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"ff44f7ed89aa6b42c2767388cb8ef0254ca2a1d31fb6d6af801463617dac581a"},"ecs":{"version":"1.6.0"},"message":"1765337601.549374\tCmrYoE1JtDK8Z0QTT5\t172.30.1.35\t61871\t172.30.1.254\t53\tudp\t19237\t0.005075\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2195.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":519711},"tags":["beats_input_codec_plain_applied"]}

Offset: 647788 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"5a3381131a73ab5e551fdea1d5411ab2530a9e26fc4fe0577e22198cbc7a3bd9"},"ecs":{"version":"1.6.0"},"message":"1765337601.576198\tCHNtja39MuYxWzvIni\t172.30.1.12\t42067\t8.8.8.8\t53\tudp\t55268\t0.026884\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t17.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.239Z","host":{"name":"f6b540842a86"},"log":{"offset":519885,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647789 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"146138627e08d4c872519f5c9413a6885cf3212e97e905cf57c6b4e31b3bc811"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337595.580777\tC2WFoq4Aso19qkUpv3\t172.30.1.2\t52270\t172.30.4.139\t1514\ttcp\t-\t2.998346\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.673Z","host":{"name":"f6b540842a86"},"log":{"offset":517434,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647790 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"cd09e84b9f798e11d842ccf2c6876b78c09f5e0ed778c700b79c6a18d416cd95"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337590.186111\tC3jcit2xzatAqZqch\t172.30.1.12\t54039\t8.8.8.8\t53\tudp\tdns\t0.027285\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:21.673Z","host":{"name":"f6b540842a86"},"log":{"offset":516926,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647791 Key: Timestamp: 2025-12-10 03:33:22.778 Headers: empty

{"@version":"1","event":{"hash":"eb4bec0ae1926339a0b119cf1dbdce16d6468929f6b26ea65792259d3019f241"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337591.216137\tCIB5OV2tVoaiNQcTAc\t172.30.1.12\t51871\t8.8.8.8\t53\tudp\tdns\t0.028175\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:22.673Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":517559},"tags":["beats_input_codec_plain_applied"]}

Offset: 647792 Key: Timestamp: 2025-12-10 03:33:24.344 Headers: empty

{"@version":"1","event":{"hash":"3c9fae87ccb0942aa96fe70be58d52801439cd563f37c18f95eef7d3f255234f"},"ecs":{"version":"1.6.0"},"message":"1765337602.362883\tCRSBfP192PJVmuZ484\t172.30.1.63\t59251\t8.8.8.8\t53\tudp\t63756\t0.026588\tconnectivity-check.ubuntu.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t185.125.190.17,185.125.190.48,91.189.91.48,91.189.91.98,185.125.190.49,185.125.190.98,91.189.91.97,91.189.91.96,185.125.190.96,185.125.190.18,185.125.190.97,91.189.91.49\t47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000,47.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:23.240Z","host":{"name":"f6b540842a86"},"log":{"offset":520059,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647793 Key: Timestamp: 2025-12-10 03:33:24.344 Headers: empty

{"@version":"1","event":{"hash":"0b10bff56467ca4da203fe2afc84fea8e1710acf6746c2bdd5ade52ba3f40689"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337591.586833\tCih45q4LJDQCkjS567\t172.30.1.35\t52089\t8.8.8.8\t53\tudp\tdns\t0.027609\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:23.674Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":517814},"tags":["beats_input_codec_plain_applied"]}

Offset: 647794 Key: Timestamp: 2025-12-10 03:33:24.344 Headers: empty

{"@version":"1","event":{"hash":"d6a50fd64d22772ba503434e3217e065fd24ce6ec057e6cf18070824c45b2cdc"},"ecs":{"version":"1.6.0"},"message":"1765337602.606213\tCx0fra2hyksXEHY67g\t172.30.1.12\t49265\t8.8.8.8\t53\tudp\t55269\t0.028467\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t30.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:23.240Z","host":{"name":"f6b540842a86"},"log":{"offset":520503,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647795 Key: Timestamp: 2025-12-10 03:33:25.777 Headers: empty

{"@version":"1","event":{"hash":"2fc0aec6b4ce440be50010cab4a7ad7e5fc99ae3219db1abe4d61218a91f23ba"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337592.256244\tCxJuiz1wdgKb0s9Gid\t172.30.1.12\t46333\t8.8.8.8\t53\tudp\tdns\t0.026666\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:24.674Z","host":{"name":"f6b540842a86"},"log":{"offset":517940,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647796 Key: Timestamp: 2025-12-10 03:33:25.777 Headers: empty

{"@version":"1","event":{"hash":"3ee5c66b161e5aedcbfefe8e87f4885651560a257b287eec354c80b0fdcaa5e3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337593.286095\tCj4CGd4ewOqJSj5GG5\t172.30.1.12\t37217\t8.8.8.8\t53\tudp\tdns\t0.035946\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:24.674Z","host":{"name":"f6b540842a86"},"log":{"offset":518064,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647797 Key: Timestamp: 2025-12-10 03:33:26.781 Headers: empty

{"@version":"1","event":{"hash":"04b8f7831a6834c978dd29bb2128980d8a2605025c167fc126dc5403598de7b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337594.326134\tCxVJEKUCWYlu35YEg\t172.30.1.12\t52943\t8.8.8.8\t53\tudp\tdns\t0.029448\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:25.674Z","host":{"name":"f6b540842a86"},"log":{"offset":518188,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647798 Key: Timestamp: 2025-12-10 03:33:26.781 Headers: empty

{"@version":"1","event":{"hash":"9d36d92edf6c55a48b1c171948a3970a366815d06f49eda7f252065bcbcfa8d7"},"ecs":{"version":"1.6.0"},"message":"1765337603.646221\tCAbdn618pEggGDeSib\t172.30.1.12\t34580\t8.8.8.8\t53\tudp\t55270\t0.106780\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t15.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:26.240Z","host":{"name":"f6b540842a86"},"log":{"offset":520677,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647799 Key: Timestamp: 2025-12-10 03:33:26.781 Headers: empty

{"@version":"1","event":{"hash":"17db2b78d73c8525c72b1dfc3487526960f9f5f82770eab752f9052c8eadb9b5"},"ecs":{"version":"1.6.0"},"message":"1765337604.686289\tCUuwoe3tfXAys5eQVg\t172.30.1.12\t38339\t8.8.8.8\t53\tudp\t55271\t0.027676\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t28.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:26.241Z","host":{"name":"f6b540842a86"},"log":{"offset":520851,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647800 Key: Timestamp: 2025-12-10 03:33:27.783 Headers: empty

{"@version":"1","event":{"hash":"fd1a27011388066457de8723b1a3777cff4e3bffc4b5484653bc86286a3128d5"},"ecs":{"version":"1.6.0"},"message":"1765337605.717110\tCZe1DY2Bpt6L06jtCl\t172.30.1.12\t39987\t8.8.8.8\t53\tudp\t55272\t0.025894\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t13.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.241Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":521025},"tags":["beats_input_codec_plain_applied"]}

Offset: 647801 Key: Timestamp: 2025-12-10 03:33:27.783 Headers: empty

{"@version":"1","event":{"hash":"07c9f4c33b1866d1ea2c8bdc4254908a74bbe587e13d71736a989fdd29c5ae21"},"ecs":{"version":"1.6.0"},"message":"1765337606.595442\tCCa1RY1mg6OwnnRrB2\t172.30.1.35\t55794\t8.8.8.8\t53\tudp\t34176\t0.028071\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1255.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.241Z","host":{"name":"f6b540842a86"},"log":{"offset":521199,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647802 Key: Timestamp: 2025-12-10 03:33:27.783 Headers: empty

{"@version":"1","event":{"hash":"c55dbddf403ac58b7cdbaa93d46d1ac33839c5bab79b6b353c65e66f7a765a9c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337595.366131\tCypXB71ffPk7s4ESg2\t172.30.1.12\t56494\t8.8.8.8\t53\tudp\tdns\t0.026960\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:26.676Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":518311},"tags":["beats_input_codec_plain_applied"]}

Offset: 647803 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"97dcd3de0380b3cbb787a02c73f7567f725bdbd0241a9cde6f8dc28195ec846c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337600.992880\tClkGO64g5NTCHb1LHh\t172.30.1.222\t65224\t8.8.8.8\t53\ttcp\tdns\t0.084419\t30\t106\tSF\tT\tF\t0\tShADadFf\t6\t282\t5\t318\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.680Z","host":{"name":"f6b540842a86"},"log":{"offset":518435,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647804 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"cb31800b71f8d317e17f024cc5be4134b145cf30be96da310e970c4a6d02fc5f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337596.553730\tCZEzmL2Wp3y1wdovfh\t172.30.1.35\t56297\t172.30.1.254\t53\tudp\tdns\t0.450833\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.680Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":518702},"tags":["beats_input_codec_plain_applied"]}

Offset: 647805 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"2eeb249c632cf0f93d54509eb4298c5ec1d2cebbb95ba670585b9bd1708b9752"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337586.541556\tCkED3YIKi93irHoi7\t172.30.1.35\t62197\t172.30.1.254\t53\tudp\tdns\t1.323321\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.680Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":518833},"tags":["beats_input_codec_plain_applied"]}

Offset: 647806 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"30f520f266377d2fe36c796850fc3d9fb11bb4e8f67fef33e25e9b5eaa3c8978"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337600.992745\tCqIk9Y2OeKRMAqZ5Yh\t172.30.1.222\t65223\t8.8.8.8\t53\ttcp\tdns\t0.087732\t30\t62\tSF\tT\tF\t0\tShADadFf\t6\t282\t5\t274\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:27.680Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":518569},"tags":["beats_input_codec_plain_applied"]}

Offset: 647807 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"0eefa6fed350bfa176b2a48ad6a32fbd48a8b9d80ad109b2203ef43dee122f84"},"ecs":{"version":"1.6.0"},"message":"1765337606.746577\tCkGXHc1VEcLbnUHFs1\t172.30.1.12\t45399\t8.8.8.8\t53\tudp\t55273\t0.027414\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t68.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:28.241Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":521368},"tags":["beats_input_codec_plain_applied"]}

Offset: 647808 Key: Timestamp: 2025-12-10 03:33:28.785 Headers: empty

{"@version":"1","event":{"hash":"50d15109310b12886ff70bd263a08e50e3fe56497ea2d484191e6f2fce6355b1"},"ecs":{"version":"1.6.0"},"message":"1765337606.564194\tCjFVTV2wlOxNv96mB\t172.30.1.35\t55794\t172.30.1.254\t53\tudp\t34176\t0.898414\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2189.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:28.241Z","host":{"name":"f6b540842a86"},"log":{"offset":521542,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647809 Key: Timestamp: 2025-12-10 03:33:29.786 Headers: empty

{"@version":"1","event":{"hash":"3695381631b9f4c0844b5a35cf78c6101a89c7d4cb904cbffb0a3ceb02f7353b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337596.593218\tCdPCqB1iwIqv6BGs2a\t172.30.1.35\t56297\t8.8.8.8\t53\tudp\tdns\t0.029504\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:28.683Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":519087},"tags":["beats_input_codec_plain_applied"]}

Offset: 647810 Key: Timestamp: 2025-12-10 03:33:29.786 Headers: empty

{"@version":"1","event":{"hash":"0c652fc948902e3c6229b91229a67f3b43a860c94fe182d6e1df9d3e8da026a9"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337597.426225\tCbt48j1o5KKgIsVNWk\t172.30.1.12\t60187\t8.8.8.8\t53\tudp\tdns\t0.028436\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:28.683Z","host":{"name":"f6b540842a86"},"log":{"offset":519213,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647811 Key: Timestamp: 2025-12-10 03:33:29.786 Headers: empty

{"@version":"1","event":{"hash":"b023b77ec48bb0debbe66ca43b6f82d96eb60d0fbb75356110e2dfc3233d377e"},"ecs":{"version":"1.6.0"},"message":"1765337607.777109\tCkV2i9PFmlNWDhE4e\t172.30.1.12\t34875\t8.8.8.8\t53\tudp\t55274\t0.029183\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t11.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:29.242Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":521715},"tags":["beats_input_codec_plain_applied"]}

Offset: 647812 Key: Timestamp: 2025-12-10 03:33:29.786 Headers: empty

{"@version":"1","event":{"hash":"8ccf12c5ced296ec5299198abdf151ddb879098c005a860439c35f51ca09a350"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337596.396145\tCU8bQp3SJn1r0f5Rb1\t172.30.1.12\t46739\t8.8.8.8\t53\tudp\tdns\t0.027525\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:28.683Z","host":{"name":"f6b540842a86"},"log":{"offset":518963,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647813 Key: Timestamp: 2025-12-10 03:33:30.786 Headers: empty

{"@version":"1","event":{"hash":"9bc5f1af1874c02d73756b72c276047f19023c08c882e66eaf3031cbf99663a7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337598.466656\tCmmEFY2gcMCIliYDk9\t172.30.1.12\t52785\t8.8.8.8\t53\tudp\tdns\t0.027751\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:29.683Z","host":{"name":"f6b540842a86"},"log":{"offset":519477,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647814 Key: Timestamp: 2025-12-10 03:33:30.786 Headers: empty

{"@version":"1","event":{"hash":"b849bec25377f1c25a6c367df8f1eef3976777833911d37244e26b7db8baec0a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337602.391334\tCj6WsGXDc4vDs0xwk\t172.30.1.63\t42096\t185.125.190.17\t80\ttcp\thttp\t0.564840\t88\t189\tSF\tT\tF\t0\tShADdfFa\t5\t356\t4\t405\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:29.683Z","host":{"name":"f6b540842a86"},"log":{"offset":519337,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647815 Key: Timestamp: 2025-12-10 03:33:30.786 Headers: empty

{"@version":"1","event":{"hash":"cafe5c17bcbd5831e3d05648975a97ccc4f05cefb392c27c092ffeebec465aa0"},"ecs":{"version":"1.6.0"},"message":"1765337608.820629\tCwqwni3yc9hXZQdCqk\t172.30.1.12\t47502\t8.8.8.8\t53\tudp\t55275\t0.024627\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t10.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:30.242Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":521888},"tags":["beats_input_codec_plain_applied"]}

Offset: 647816 Key: Timestamp: 2025-12-10 03:33:31.788 Headers: empty

{"@version":"1","event":{"hash":"f72c1fa554678849bc955a85267c90f141716311c15b63e2ad18fb958b25fadd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337604.142459\tCVnBP43EA1N1FYKQz9\t172.30.1.63\t54232\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:30.684Z","host":{"name":"f6b540842a86"},"log":{"offset":519601,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647817 Key: Timestamp: 2025-12-10 03:33:31.788 Headers: empty

{"@version":"1","event":{"hash":"5637fca0f1369e408762bca08275d8ed11fbeaabc6fa533d9dfb3ad2b90e8160"},"ecs":{"version":"1.6.0"},"message":"1765337609.856578\tCxC3lE3KzgiqL0MERj\t172.30.1.12\t60598\t8.8.8.8\t53\tudp\t55276\t0.029531\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t9.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:31.245Z","host":{"name":"f6b540842a86"},"log":{"offset":522235,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647818 Key: Timestamp: 2025-12-10 03:33:31.788 Headers: empty

{"@version":"1","event":{"hash":"7365157e66f57fb2746a0182586955093bdc2f4bd955daf0dd0bd599cc0fbf3d"},"ecs":{"version":"1.6.0"},"message":"1765337609.887751\tC9tCvW1qBRIudSOWS9\t172.30.1.12\t41005\t8.8.8.8\t53\tudp\t55277\t0.028882\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t9.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:31.245Z","host":{"name":"f6b540842a86"},"log":{"offset":522062,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647819 Key: Timestamp: 2025-12-10 03:33:32.790 Headers: empty

{"@version":"1","event":{"hash":"6f60a63481b1ee7b06a374e680664a8a6d05cbf6906ecdead8d7b1aeb5efec4a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337549.764918\tCbWdBs1jUjrYJ2dAJ\t172.30.1.132\t40420\t216.239.35.12\t123\tudp\tntp\t0.031834\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:31.684Z","host":{"name":"f6b540842a86"},"log":{"offset":519719,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647820 Key: Timestamp: 2025-12-10 03:33:32.790 Headers: empty

{"@version":"1","event":{"hash":"96b920fe78ea3ea59885690c4a5d7a33925daf2cae32c02f8438a82506a0491c"},"ecs":{"version":"1.6.0"},"message":"1765337611.546037\tC3WTSy4pZ0m9J5aZh3\t172.30.1.35\t55109\t172.30.1.254\t53\tudp\t25590\t0.004130\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2185.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.245Z","host":{"name":"f6b540842a86"},"log":{"offset":522408,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647821 Key: Timestamp: 2025-12-10 03:33:32.790 Headers: empty

{"@version":"1","event":{"hash":"28d5735f5a1bd6c07eb4bcea0b24e8913de6a5ec51869cfd7f160ba2c86839c6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337599.506325\tCF3Jif2jljqEfESCt8\t172.30.1.12\t56783\t8.8.8.8\t53\tudp\tdns\t0.027913\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:31.685Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":519850},"tags":["beats_input_codec_plain_applied"]}

Offset: 647822 Key: Timestamp: 2025-12-10 03:33:32.791 Headers: empty

{"@version":"1","event":{"hash":"35fa83612ae00a38cf087d931305219195c9e803589440d6ac8cec1b270d3bc1"},"ecs":{"version":"1.6.0"},"message":"1765337610.926258\tCYvAPg3Cmkbtgzm8W3\t172.30.1.12\t32927\t8.8.8.8\t53\tudp\t55278\t0.029348\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t8.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.246Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":522582},"tags":["beats_input_codec_plain_applied"]}

Offset: 647823 Key: Timestamp: 2025-12-10 03:33:33.791 Headers: empty

{"@version":"1","event":{"hash":"98dac0e47251d86b9245906113bcd1a5b5c05a220ce636f11a5ce714aa850a0e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337601.549374\tCmrYoE1JtDK8Z0QTT5\t172.30.1.35\t61871\t172.30.1.254\t53\tudp\tdns\t0.005075\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.685Z","host":{"name":"f6b540842a86"},"log":{"offset":520098,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647824 Key: Timestamp: 2025-12-10 03:33:33.791 Headers: empty

{"@version":"1","event":{"hash":"df80a28bad97fb89fcf8b658cc5a0e320cc170e116ce153a3bb3d35209734de7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337601.576198\tCHNtja39MuYxWzvIni\t172.30.1.12\t42067\t8.8.8.8\t53\tudp\tdns\t0.026884\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.685Z","host":{"name":"f6b540842a86"},"log":{"offset":520229,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647825 Key: Timestamp: 2025-12-10 03:33:33.791 Headers: empty

{"@version":"1","event":{"hash":"1a93fecc9d27dc6d220351de7c4dfdd643ce4bef066efb3872fe21b05bd12f44"},"ecs":{"version":"1.6.0"},"message":"1765337602.709247\tCj6WsGXDc4vDs0xwk\t172.30.1.63\t42096\t185.125.190.17\t80\t1\tGET\tconnectivity-check.ubuntu.com.\t/\t-\t1.1\t-\t-\t0\t0\t204\tNo Content\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\t-\t-\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.718Z","host":{"name":"f6b540842a86"},"log":{"offset":21134,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647826 Key: Timestamp: 2025-12-10 03:33:33.791 Headers: empty

{"@version":"1","event":{"hash":"6392d31ed6387e03d5b1fbd73d97320c215b5bb6c3f7e5db1c9e2e2224327268"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337600.536169\tC80vTe3P0vCw2Hwxl9\t172.30.1.12\t49825\t8.8.8.8\t53\tudp\tdns\t0.028649\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:32.685Z","host":{"name":"f6b540842a86"},"log":{"offset":519974,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647827 Key: Timestamp: 2025-12-10 03:33:33.791 Headers: empty

{"@version":"1","event":{"hash":"cf117afb5665c800379cd2d1abc4c5187e0d990bc646dac28b1714b34cc09766"},"ecs":{"version":"1.6.0"},"message":"1765337611.966295\tCKExUa3N7M3lMoW15k\t172.30.1.12\t48171\t8.8.8.8\t53\tudp\t55279\t0.027694\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t7.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:33.246Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":522755},"tags":["beats_input_codec_plain_applied"]}

Offset: 647828 Key: Timestamp: 2025-12-10 03:33:34.791 Headers: empty

{"@version":"1","event":{"hash":"87f1f441fb5dc93ab4ebb678c8b643d69e5f8c5a7cc07197714286b4085c17cd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337602.362883\tCRSBfP192PJVmuZ484\t172.30.1.63\t59251\t8.8.8.8\t53\tudp\tdns\t0.026588\t58\t250\tSF\tT\tF\t0\tDd\t1\t86\t1\t278\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:33.688Z","host":{"name":"f6b540842a86"},"log":{"offset":520478,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647829 Key: Timestamp: 2025-12-10 03:33:34.791 Headers: empty

{"@version":"1","event":{"hash":"164d49a837d56be94b9fe8e7610b186b4781914d7474ac948a6a4839f2a6f7d2"},"ecs":{"version":"1.6.0"},"message":"1765337612.996254\tC55HQw2OyfPPTyUJOf\t172.30.1.12\t38187\t8.8.8.8\t53\tudp\t55280\t0.028855\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t5.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:34.246Z","host":{"name":"f6b540842a86"},"log":{"offset":522928,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647830 Key: Timestamp: 2025-12-10 03:33:34.791 Headers: empty

{"@version":"1","event":{"hash":"c1bae11241e27cf1ca528bdb489e37c82d141955969472dff2ceefa0f45d7062"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337606.608234\tCN0Bt13dlE4Mepvyzh\t172.30.1.2\t59944\t172.30.4.136\t5044\ttcp\t-\t2.990815\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:33.688Z","host":{"name":"f6b540842a86"},"log":{"offset":520353,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647831 Key: Timestamp: 2025-12-10 03:33:35.795 Headers: empty

{"@version":"1","event":{"hash":"90f251dda113ab941102b75e3a124e17d7671e10abc51c94126c0360f5195841"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337608.580341\tCI1vze3IIUxN59m8gc\t172.30.1.2\t52274\t172.30.4.139\t1514\ttcp\t-\t2.999345\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:34.689Z","host":{"name":"f6b540842a86"},"log":{"offset":520728,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647832 Key: Timestamp: 2025-12-10 03:33:35.795 Headers: empty

{"@version":"1","event":{"hash":"cad6e0bcb6e4a62f756754fd3d3dfd256b0ae42a770b31ef237bffe9d86072e5"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337602.606213\tCx0fra2hyksXEHY67g\t172.30.1.12\t49265\t8.8.8.8\t53\tudp\tdns\t0.028467\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:34.689Z","host":{"name":"f6b540842a86"},"log":{"offset":520604,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647833 Key: Timestamp: 2025-12-10 03:33:35.795 Headers: empty

{"@version":"1","event":{"hash":"fea0d2ead533451b393ca5439b6fe2eb72ed5599689659051587698efa995343"},"ecs":{"version":"1.6.0"},"message":"1765337614.036355\tC8zz6j36YqOblXOd9i\t172.30.1.12\t43079\t8.8.8.8\t53\tudp\t55281\t0.027757\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t4.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:35.247Z","host":{"name":"f6b540842a86"},"log":{"offset":523101,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647834 Key: Timestamp: 2025-12-10 03:33:35.795 Headers: empty

{"@version":"1","event":{"hash":"39177b5cc853bb78c4a636d3dd9d8f1226b2c451a536f544fc3d7fd12c7452c1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337603.646221\tCAbdn618pEggGDeSib\t172.30.1.12\t34580\t8.8.8.8\t53\tudp\tdns\t0.028939\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:34.689Z","host":{"name":"f6b540842a86"},"log":{"offset":520853,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 647835 Key: Timestamp: 2025-12-10 03:33:36.792 Headers: empty

{"@version":"1","event":{"hash":"9785e6250d0cf2fb6dd437453ccca77874c0d63d1b3dd8b441a960a055fa94c2"},"ecs":{"version":"1.6.0"},"message":"1765337615.066326\tCdYnNB4JUQmAnLSwea\t172.30.1.12\t52584\t8.8.8.8\t53\tudp\t55282\t0.027339\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t3.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:33:36.247Z","host":{"name":"f6b540842a86"},"log":{"offset":523274,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network