Kafdrop: Topic: logstash-local-network: Messages

Offset: 653588 Key: Timestamp: 2025-12-10 03:59:38.308 Headers: empty

{"@version":"1","event":{"hash":"ef400c573d0e4cedad04d2c8dddc25c8a3a891c9ad8f4c5e881d9c9462b82bb3"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339165.261337\tCmykV93I0Ykio4bXIe\t172.30.1.12\t57382\t8.8.8.8\t53\tudp\tdns\t0.027209\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:37.205Z","host":{"name":"f6b540842a86"},"log":{"offset":915142,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653589 Key: Timestamp: 2025-12-10 03:59:38.308 Headers: empty

{"@version":"1","event":{"hash":"bf831265c1eddf8889d1f8afbfa922d545fc4f0bf5cb174da8c95c3b5fd2fde3"},"ecs":{"version":"1.6.0"},"message":"1765339175.611438\tCTTcU91uZzWfB4Vnd4\t172.30.1.12\t45072\t8.8.8.8\t53\tudp\t56804\t0.028397\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t222.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:37.652Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":909741},"tags":["beats_input_codec_plain_applied"]}

Offset: 653590 Key: Timestamp: 2025-12-10 03:59:39.309 Headers: empty

{"@version":"1","event":{"hash":"9105a8fe117c4d27a05997e14fc1d6e9a3f73418a950f8879aaac69debc59dc1"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339166.291454\tCHiOCA1VwRnKMkP6q8\t172.30.1.12\t37175\t8.8.8.8\t53\tudp\tdns\t0.027719\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:38.206Z","host":{"name":"f6b540842a86"},"log":{"offset":915266,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653591 Key: Timestamp: 2025-12-10 03:59:39.309 Headers: empty

{"@version":"1","event":{"hash":"fdc315116a251cf55f7967eb4b823ff6984df7ce970dd5295541f8fcc6347b4f"},"ecs":{"version":"1.6.0"},"message":"1765339176.651441\tCWFind4P98NdwVAkc\t172.30.1.12\t51065\t8.8.8.8\t53\tudp\t56805\t0.028635\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t193.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:38.653Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":909916},"tags":["beats_input_codec_plain_applied"]}

Offset: 653592 Key: Timestamp: 2025-12-10 03:59:39.309 Headers: empty

{"@version":"1","event":{"hash":"0054c5541bcd88ae5408e440e7956137fbf92b95a31a9aa0375a407ad6b40a30"},"ecs":{"version":"1.6.0"},"message":"1765339176.620319\tCxDhVo2rPibcaHNBG5\t172.30.1.35\t62543\t172.30.1.254\t53\tudp\t12602\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t620.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:38.653Z","host":{"name":"f6b540842a86"},"log":{"offset":910090,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653593 Key: Timestamp: 2025-12-10 03:59:39.309 Headers: empty

{"@version":"1","event":{"hash":"01643016eedbd66824f27f2557bb72097d931193987aaf2dfc999b4fb5e34a47"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339166.559574\tCFB5uC1PNavNyS7us3\t172.30.1.35\t53553\t172.30.1.254\t53\tudp\tdns\t0.004870\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:38.206Z","host":{"name":"f6b540842a86"},"log":{"offset":915390,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653594 Key: Timestamp: 2025-12-10 03:59:40.314 Headers: empty

{"@version":"1","event":{"hash":"ed0d54d107301fce94d21368946dbbff6405b3ff9888d58c1d1893825de2d503"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339167.321429\tCSUCnl10y6LaLgUzi9\t172.30.1.12\t55597\t8.8.8.8\t53\tudp\tdns\t0.027470\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:39.211Z","host":{"name":"f6b540842a86"},"log":{"offset":915521,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653595 Key: Timestamp: 2025-12-10 03:59:40.314 Headers: empty

{"@version":"1","event":{"hash":"22c227687d661d62a6944e5e83a513d118b5234ef44dd2b078101c52de55fab2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339172.650100\tCnSuKK0FFEMOqImE9\t172.30.1.2\t52616\t172.30.4.139\t1514\ttcp\t-\t2.999066\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:39.211Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":915645},"tags":["beats_input_codec_plain_applied"]}

Offset: 653596 Key: Timestamp: 2025-12-10 03:59:40.314 Headers: empty

{"@version":"1","event":{"hash":"af740af31c1d445f71d560eb13e9aad990ac5733f80e37ff26747813eed0af38"},"ecs":{"version":"1.6.0"},"message":"1765339177.691546\tC9Vdk321A24XpCitcl\t172.30.1.12\t60947\t8.8.8.8\t53\tudp\t56806\t0.028939\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t155.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:39.653Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":910256},"tags":["beats_input_codec_plain_applied"]}

Offset: 653597 Key: Timestamp: 2025-12-10 03:59:41.315 Headers: empty

{"@version":"1","event":{"hash":"a357c299f7d3b9eb52081b3ff5c64a65717d7af1bbf947c0bef7ef4eaf06f1d8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339168.356223\tC3ZW4R3okzO1VhGn52\t172.30.1.12\t55573\t8.8.8.8\t53\tudp\tdns\t0.028262\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:40.211Z","host":{"name":"f6b540842a86"},"log":{"offset":915769,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653598 Key: Timestamp: 2025-12-10 03:59:41.315 Headers: empty

{"@version":"1","event":{"hash":"b15295adea786a5960347be65fc910519104a38d8e5e909925a6713482107731"},"ecs":{"version":"1.6.0"},"message":"1765339178.731520\tCTjdAy1s9oRJyNJVH8\t172.30.1.12\t33462\t8.8.8.8\t53\tudp\t56807\t0.029553\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:40.653Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":910431},"tags":["beats_input_codec_plain_applied"]}

Offset: 653599 Key: Timestamp: 2025-12-10 03:59:42.319 Headers: empty

{"@version":"1","event":{"hash":"5279ea3ce7152a8e3ef75f98e8215a57e3a7672f562794397fccccbf555e56ac"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339170.421346\tCBB3nu227o7vrsAqjl\t172.30.1.12\t33646\t8.8.8.8\t53\tudp\tdns\t0.028321\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:41.212Z","host":{"name":"f6b540842a86"},"log":{"offset":916017,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653600 Key: Timestamp: 2025-12-10 03:59:42.319 Headers: empty

{"@version":"1","event":{"hash":"3ba3ed3904de1ef23c27919546d1fdec5572f917b133ab17892d9781181254c5"},"ecs":{"version":"1.6.0"},"message":"1765339179.771678\tC8nTCC4YKNdyloESxc\t172.30.1.12\t54203\t8.8.8.8\t53\tudp\t56808\t0.027178\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t153.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:41.654Z","host":{"name":"f6b540842a86"},"log":{"offset":910606,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653601 Key: Timestamp: 2025-12-10 03:59:42.319 Headers: empty

{"@version":"1","event":{"hash":"53e64d910445f6a006514b3996cee5babf704e7f78b281bf060accfc581093cc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339169.391486\tCxZnmw31HETPZoZw81\t172.30.1.12\t38307\t8.8.8.8\t53\tudp\tdns\t0.027100\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:41.212Z","host":{"name":"f6b540842a86"},"log":{"offset":915893,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653602 Key: Timestamp: 2025-12-10 03:59:43.319 Headers: empty

{"@version":"1","event":{"hash":"5995abef1889bfb4f461489b46d130de981aa23f2fc538c51596ad2bf000bcf7"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339171.559714\tCL8J943Jzz5kbcFhx\t172.30.1.35\t55625\t172.30.1.254\t53\tudp\tdns\t0.005307\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:42.212Z","host":{"name":"f6b540842a86"},"log":{"offset":916141,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653603 Key: Timestamp: 2025-12-10 03:59:43.319 Headers: empty

{"@version":"1","event":{"hash":"0d49246e9a3e844055fdb5b332f3231ecf68866eb64b7cf127c23929d48494f4"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339172.501408\tCQfPhk1lWXIKP4KeP8\t172.30.1.12\t46730\t8.8.8.8\t53\tudp\tdns\t0.029608\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:43.212Z","host":{"name":"f6b540842a86"},"log":{"offset":916395,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653604 Key: Timestamp: 2025-12-10 03:59:43.319 Headers: empty

{"@version":"1","event":{"hash":"385c293faf45a478aa9b10270117c9cace6f97bfc1860c0ea2248da7cd13aed3"},"ecs":{"version":"1.6.0"},"message":"1765339180.801475\tCojzS61rm8if7Xr332\t172.30.1.12\t59472\t8.8.8.8\t53\tudp\t56809\t0.028527\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t238.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:42.654Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":910781},"tags":["beats_input_codec_plain_applied"]}

Offset: 653605 Key: Timestamp: 2025-12-10 03:59:43.319 Headers: empty

{"@version":"1","event":{"hash":"7738ad1b666eb275da6727f1f076b1ae79405eaa7529b2201dd26b2d22a9f1a2"},"ecs":{"version":"1.6.0"},"message":"1765339181.559719\tCmH9B11bafnxXRBKle\t172.30.1.35\t50109\t172.30.1.254\t53\tudp\t55234\t0.004837\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t615.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:42.654Z","host":{"name":"f6b540842a86"},"log":{"offset":910956,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653606 Key: Timestamp: 2025-12-10 03:59:43.319 Headers: empty

{"@version":"1","event":{"hash":"f85633bdca99a7f50c475776b808d01126e8c8704fd1c1909f8a1ceffeda8e9c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339171.461372\tCse8g019lWhq21F1P9\t172.30.1.12\t55220\t8.8.8.8\t53\tudp\tdns\t0.030225\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:42.212Z","host":{"name":"f6b540842a86"},"log":{"offset":916271,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653607 Key: Timestamp: 2025-12-10 03:59:44.758 Headers: empty

{"@version":"1","event":{"hash":"ddf29c46b83a01b32355d36d392dd1420b9e41cf325c7c86266f4d3e2ee42423"},"ecs":{"version":"1.6.0"},"message":"1765339181.841574\tCYRMnU2MqNKr0kkLTc\t172.30.1.12\t57686\t8.8.8.8\t53\tudp\t56810\t0.026893\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t216.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:43.654Z","host":{"name":"f6b540842a86"},"log":{"offset":911129,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653608 Key: Timestamp: 2025-12-10 03:59:44.758 Headers: empty

{"@version":"1","event":{"hash":"6be70d7a16c66d979729a819aed35ee3ee5ce548cb0fbf263537f2572e243e3f"},"ecs":{"version":"1.6.0"},"message":"1765339182.871496\tCLwzke2w2cgMuuFVDe\t172.30.1.12\t42030\t8.8.8.8\t53\tudp\t56811\t0.029095\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t187.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:44.655Z","host":{"name":"f6b540842a86"},"log":{"offset":911304,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653609 Key: Timestamp: 2025-12-10 03:59:44.758 Headers: empty

{"@version":"1","event":{"hash":"94daa50a8f68eda974729dc7da7a98c6401a709d8e35b51f9f94f0cac0f07de9"},"ecs":{"version":"1.6.0"},"message":"1765339182.902100\tCIoNJr3YYUZubglMZ5\t172.30.1.12\t57417\t8.8.8.8\t53\tudp\t56812\t0.027476\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t279.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:44.655Z","host":{"name":"f6b540842a86"},"log":{"offset":911479,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653610 Key: Timestamp: 2025-12-10 03:59:46.761 Headers: empty

{"@version":"1","event":{"hash":"bb80334a3a49b46b2d6f44ec8e0c47425615603d7570af9177cb6b6177d81ddd"},"ecs":{"version":"1.6.0"},"message":"1765339183.932184\tCmA4wW1t91wmmpgPue\t172.30.1.12\t39599\t8.8.8.8\t53\tudp\t56813\t0.029104\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t214.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:45.655Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":911654},"tags":["beats_input_codec_plain_applied"]}

Offset: 653611 Key: Timestamp: 2025-12-10 03:59:46.761 Headers: empty

{"@version":"1","event":{"hash":"a776cc92036fb287b0fccb388e33b316b353956d5bc4580b1863689f6de36360"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339174.581405\tCll8QWfBxoO7VCJW5\t172.30.1.12\t40567\t8.8.8.8\t53\tudp\tdns\t0.027656\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:46.213Z","host":{"name":"f6b540842a86"},"log":{"offset":916643,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653612 Key: Timestamp: 2025-12-10 03:59:46.761 Headers: empty

{"@version":"1","event":{"hash":"6d5d77b1a25342abea1b4b7eeb7617b01fc5d18a97f064312f943910b81627de"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339173.541493\tCmxkID3gUMM49LQH6d\t172.30.1.12\t55794\t8.8.8.8\t53\tudp\tdns\t0.028904\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:46.213Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":916519},"tags":["beats_input_codec_plain_applied"]}

Offset: 653613 Key: Timestamp: 2025-12-10 03:59:46.761 Headers: empty

{"@version":"1","event":{"hash":"40423f77e3e6d0e4a7ed966ffcf274deef7d65e6656548d194e84e280f9259df"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339175.611438\tCTTcU91uZzWfB4Vnd4\t172.30.1.12\t45072\t8.8.8.8\t53\tudp\tdns\t0.028397\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:46.213Z","host":{"name":"f6b540842a86"},"log":{"offset":916766,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653614 Key: Timestamp: 2025-12-10 03:59:47.761 Headers: empty

{"@version":"1","event":{"hash":"804db59f741180c58ac8a97f08477fdd8a920a7eff683ff16c98f9a58a933e5f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339176.556655\tCxDhVo2rPibcaHNBG5\t172.30.1.35\t62543\t172.30.1.254\t53\tudp\tdns\t0.004461\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:47.214Z","host":{"name":"f6b540842a86"},"log":{"offset":916890,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653615 Key: Timestamp: 2025-12-10 03:59:47.761 Headers: empty

{"@version":"1","event":{"hash":"35f6c88b0f4dfdb64e13428a037219ade4c4800e6880a974fd074d7b65122dbb"},"ecs":{"version":"1.6.0"},"message":"1765339184.971542\tCpxjAo3zZRojT6E952\t172.30.1.12\t60295\t8.8.8.8\t53\tudp\t56814\t0.028171\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t277.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:46.656Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":911829},"tags":["beats_input_codec_plain_applied"]}

Offset: 653616 Key: Timestamp: 2025-12-10 03:59:48.762 Headers: empty

{"@version":"1","event":{"hash":"0fdbdf0d7b317e335d86b78c9811561b69210b70423ee850b951a9f574e177da"},"ecs":{"version":"1.6.0"},"message":"1765339186.569785\tCrNgfr1AgUCqJOe6F5\t172.30.1.35\t61012\t172.30.1.254\t53\tudp\t41969\t0.029318\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t610.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:47.658Z","host":{"name":"f6b540842a86"},"log":{"offset":912178,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653617 Key: Timestamp: 2025-12-10 03:59:48.762 Headers: empty

{"@version":"1","event":{"hash":"50012e282a2122790613e8df008b38e1aab87199a3f2c198f2cef61d0af0746e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339176.651441\tCWFind4P98NdwVAkc\t172.30.1.12\t51065\t8.8.8.8\t53\tudp\tdns\t0.028635\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:48.214Z","host":{"name":"f6b540842a86"},"log":{"offset":917021,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653618 Key: Timestamp: 2025-12-10 03:59:48.762 Headers: empty

{"@version":"1","event":{"hash":"f2ff4912931917159e9a435e7df0ba743d466d99e483e23cda394fbc77e8e9f1"},"ecs":{"version":"1.6.0"},"message":"1765339186.001540\tCgHbEOIOcPf5THa65\t172.30.1.12\t50958\t8.8.8.8\t53\tudp\t56815\t0.028340\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t146.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:47.658Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":912004},"tags":["beats_input_codec_plain_applied"]}

Offset: 653619 Key: Timestamp: 2025-12-10 03:59:49.765 Headers: empty

{"@version":"1","event":{"hash":"d32044470a461e05cdca38fff7c3a798e583c390d6cb5da334cc60064ab8ec1c"},"ecs":{"version":"1.6.0"},"message":"1765339187.089007\tCHGfFM3cmRnzYFywu8\t172.30.1.12\t35538\t8.8.8.8\t53\tudp\t56816\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t145.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:48.659Z","host":{"name":"f6b540842a86"},"log":{"offset":912351,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653620 Key: Timestamp: 2025-12-10 03:59:49.765 Headers: empty

{"@version":"1","event":{"hash":"f0a3c88b5e333abf1de633151db8a80607d98c1701db0a06a42462e9f9ca14a8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339177.691546\tC9Vdk321A24XpCitcl\t172.30.1.12\t60947\t8.8.8.8\t53\tudp\tdns\t0.028939\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:49.214Z","host":{"name":"f6b540842a86"},"log":{"offset":917144,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653621 Key: Timestamp: 2025-12-10 03:59:49.765 Headers: empty

{"@version":"1","event":{"hash":"191bc52043ec1c1af762905ce33c82451366b8ba12890175b211f7737cc614b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339178.731520\tCTjdAy1s9oRJyNJVH8\t172.30.1.12\t33462\t8.8.8.8\t53\tudp\tdns\t0.029553\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:49.214Z","host":{"name":"f6b540842a86"},"log":{"offset":917268,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653622 Key: Timestamp: 2025-12-10 03:59:50.763 Headers: empty

{"@version":"1","event":{"hash":"67e8ebf29bcd1c48cb6f8e03de473acf9aa7c5d8430308802cb9fdf816c7fb07"},"ecs":{"version":"1.6.0"},"message":"1765339188.081541\tCcg6br1Xww2P4aR7gb\t172.30.1.12\t50632\t8.8.8.8\t53\tudp\t56817\t0.027322\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t181.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:49.660Z","host":{"name":"f6b540842a86"},"log":{"offset":912519,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653623 Key: Timestamp: 2025-12-10 03:59:50.763 Headers: empty

{"@version":"1","event":{"hash":"6140317f9ec72b4bab177cc257a66b65331fa1133ace7eea79dc5453d499baa5"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339179.771678\tC8nTCC4YKNdyloESxc\t172.30.1.12\t54203\t8.8.8.8\t53\tudp\tdns\t0.027178\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:50.215Z","host":{"name":"f6b540842a86"},"log":{"offset":917392,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653624 Key: Timestamp: 2025-12-10 03:59:51.763 Headers: empty

{"@version":"1","event":{"hash":"39638c39d94da2f8daac48de825b7efe79a09e4060f3eb66a7efe3caed653231"},"ecs":{"version":"1.6.0"},"message":"1765339189.111601\tCFh7J11WmRRAHbF9ye\t172.30.1.12\t51334\t8.8.8.8\t53\tudp\t56818\t0.034624\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t285.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:50.660Z","host":{"name":"f6b540842a86"},"log":{"offset":912694,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653625 Key: Timestamp: 2025-12-10 03:59:51.764 Headers: empty

{"@version":"1","event":{"hash":"df17f6657af258656a80f60af53fe3e61e9d2e1138e964c63e80d8c7ae7fc499"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339185.650007\tCvjoqRdng4C1ddq4f\t172.30.1.2\t52618\t172.30.4.139\t1514\ttcp\t-\t2.999103\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:51.215Z","host":{"name":"f6b540842a86"},"log":{"offset":917516,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653626 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"c11928e4283602a04b96b90113a3082dac427235d04a700db75c6402764fcf79"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339180.801475\tCojzS61rm8if7Xr332\t172.30.1.12\t59472\t8.8.8.8\t53\tudp\tdns\t0.028527\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:52.215Z","host":{"name":"f6b540842a86"},"log":{"offset":917640,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653627 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"774861acc863c26bfb0d231d55e30104cc30c27a2c4f46ae77310c4a68d8c8fe"},"ecs":{"version":"1.6.0"},"message":"1765339191.192060\tCbAAL33bCl1q9G6rKb\t172.30.1.12\t46186\t8.8.8.8\t53\tudp\t56820\t0.027828\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t141.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:52.661Z","host":{"name":"f6b540842a86"},"log":{"offset":913212,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653628 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"e41dd716a5c12debee9d044fa61eff6fdbea04ef9d2d22725938a31c55541e79"},"ecs":{"version":"1.6.0"},"message":"1765339190.151548\tChO9Ur1CGPaWKBaFn6\t172.30.1.12\t37801\t8.8.8.8\t53\tudp\t56819\t0.030137\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t142.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:51.661Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":912869},"tags":["beats_input_codec_plain_applied"]}

Offset: 653629 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"3aaabad9cc35d3c910050c74744471bdc3c56840188c03cf4461f416aaec9481"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339181.559719\tCmH9B11bafnxXRBKle\t172.30.1.35\t50109\t172.30.1.254\t53\tudp\tdns\t0.004837\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:52.216Z","host":{"name":"f6b540842a86"},"log":{"offset":917764,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653630 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"204a7fb8f7a53c857c3a1f366c085c7f08f97186ce8251bc1eb72f3536a84254"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339181.841574\tCYRMnU2MqNKr0kkLTc\t172.30.1.12\t57686\t8.8.8.8\t53\tudp\tdns\t0.026893\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:52.216Z","host":{"name":"f6b540842a86"},"log":{"offset":917895,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653631 Key: Timestamp: 2025-12-10 03:59:52.765 Headers: empty

{"@version":"1","event":{"hash":"7219636e448c738f351874dc245f9542ce9392a297abc6bbacc700bdc6dc6d46"},"ecs":{"version":"1.6.0"},"message":"1765339191.605858\tCC4AGk1F0nDHR91qHj\t172.30.1.35\t52684\t8.8.8.8\t53\tudp\t65347\t0.027003\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t647.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:52.661Z","host":{"name":"f6b540842a86"},"log":{"offset":913044,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653632 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"2471ab9a6075e0bb1541a01d494ec6aa703dc0861b970353d89a6696608bf49d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339182.871496\tCLwzke2w2cgMuuFVDe\t172.30.1.12\t42030\t8.8.8.8\t53\tudp\tdns\t0.029095\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.216Z","host":{"name":"f6b540842a86"},"log":{"offset":918019,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653633 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"a2322bebbb46b4c5f3d504fd33132b527ce143aff69e168cc5927aa1b32d8bca"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339182.902100\tCIoNJr3YYUZubglMZ5\t172.30.1.12\t57417\t8.8.8.8\t53\tudp\tdns\t0.027476\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.216Z","host":{"name":"f6b540842a86"},"log":{"offset":918143,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653634 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"1b979dafc6e45ffb946c90fb83967906e5d728c9125a78f03b7cf96c79a446e6"},"ecs":{"version":"1.6.0"},"message":"1765339192.231573\tCi2R7CZu8CJXqBk9k\t172.30.1.12\t52650\t8.8.8.8\t53\tudp\t56821\t0.026957\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t282.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.662Z","host":{"name":"f6b540842a86"},"log":{"offset":913387,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653635 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"ff099521e39c03f2b53f5dbe268417462131bec61d6cda892e4f6ac43c5f8a67"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339183.932184\tCmA4wW1t91wmmpgPue\t172.30.1.12\t39599\t8.8.8.8\t53\tudp\tdns\t0.029104\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.216Z","host":{"name":"f6b540842a86"},"log":{"offset":918267,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653636 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"b67dc02f180fa513968c153a32a128a9c760081179cbf61e113cb5b7ed6dda74"},"ecs":{"version":"1.6.0"},"message":"1765339193.261661\tCyB8aEIdVMWtKSeC9\t172.30.1.12\t34734\t8.8.8.8\t53\tudp\t56822\t0.028940\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t225.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.662Z","host":{"name":"f6b540842a86"},"log":{"offset":913561,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653637 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"ed86d18d61616d60d1e6946b537322e0b8e31a5d688d02a4c6c70a3bc1a53997"},"ecs":{"version":"1.6.0"},"message":"1765339191.566844\tCWmUwA3LZ9aiMRPKYa\t172.30.1.35\t52684\t172.30.1.254\t53\tudp\t65347\t2.012277\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t629.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.662Z","host":{"name":"f6b540842a86"},"log":{"offset":913735,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653638 Key: Timestamp: 2025-12-10 03:59:56.320 Headers: empty

{"@version":"1","event":{"hash":"616c6bd34c10b36fd680e9ae6ccd375ff1370478a397f613b4e796523a3a89c6"},"ecs":{"version":"1.6.0"},"message":"1765339194.302184\tC7jE7y3nud5DmE6oWb\t172.30.1.12\t59526\t8.8.8.8\t53\tudp\t56823\t0.030662\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t280.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:55.662Z","host":{"name":"f6b540842a86"},"log":{"offset":913908,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653639 Key: Timestamp: 2025-12-10 03:59:57.321 Headers: empty

{"@version":"1","event":{"hash":"4f8a7750c066270f056d6ef308163d147dd74668e89042cd71cd012169a68ddb"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339184.971542\tCpxjAo3zZRojT6E952\t172.30.1.12\t60295\t8.8.8.8\t53\tudp\tdns\t0.028171\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:56.218Z","host":{"name":"f6b540842a86"},"log":{"offset":918391,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653640 Key: Timestamp: 2025-12-10 03:59:57.321 Headers: empty

{"@version":"1","event":{"hash":"f34a937da8f78ece24379f4a23856651d11aecc1c47a33f82bbf15429d637514"},"ecs":{"version":"1.6.0"},"message":"1765339194.939543\tCfGZus2o3rP8QKkL6b\t172.30.1.15\t4359\t8.8.8.8\t53\tudp\t1455\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:56.662Z","host":{"name":"f6b540842a86"},"log":{"offset":914226,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653641 Key: Timestamp: 2025-12-10 03:59:57.321 Headers: empty

{"@version":"1","event":{"hash":"4165d5d41c79554548adb91e2e1404cfd75709ce117437b48d2bdbf79521d9d8"},"ecs":{"version":"1.6.0"},"message":"1765339194.874593\tCyssO82AWwNZ1WGSbi\t172.30.1.15\t4357\t8.8.8.8\t53\tudp\t1455\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:56.662Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":914083},"tags":["beats_input_codec_plain_applied"]}

Offset: 653642 Key: Timestamp: 2025-12-10 03:59:57.321 Headers: empty

{"@version":"1","event":{"hash":"b3bc66ecc627264289fd13f3aad4475044795ebf86839a3b0a6963c84c65d784"},"ecs":{"version":"1.6.0"},"message":"1765339194.970485\tCHOlkqdT78D6AtsQ2\t172.30.1.15\t4360\t8.8.8.8\t53\tudp\t1455\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:56.662Z","host":{"name":"f6b540842a86"},"log":{"offset":914369,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653643 Key: Timestamp: 2025-12-10 03:59:57.321 Headers: empty

{"@version":"1","event":{"hash":"a805785faa893c7bfb8c334266904bccf23de846da0183c21ca544dc3b91ff52"},"ecs":{"version":"1.6.0"},"message":"1765339195.005500\tC7mqm51irqGCVuzqX2\t172.30.1.15\t4361\t8.8.8.8\t53\tudp\t1455\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:56.662Z","host":{"name":"f6b540842a86"},"log":{"offset":914511,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653644 Key: Timestamp: 2025-12-10 03:59:58.324 Headers: empty

{"@version":"1","event":{"hash":"0c773605f09e42e2bdca2de86366e7b52ec5816b6ef935fb6f1e5812b326fe22"},"ecs":{"version":"1.6.0"},"message":"1765339194.909506\tCIV2461vna3FNNVYda\t172.30.1.15\t4358\t8.8.8.8\t53\tudp\t1455\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:57.662Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":914654},"tags":["beats_input_codec_plain_applied"]}

Offset: 653645 Key: Timestamp: 2025-12-10 03:59:58.324 Headers: empty

{"@version":"1","event":{"hash":"a182016dde2cf7c2120d40c3d93ff9d4d214277fcb2acd711b1183c01154a006"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339186.001540\tCgHbEOIOcPf5THa65\t172.30.1.12\t50958\t8.8.8.8\t53\tudp\tdns\t0.028340\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:57.219Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":918515},"tags":["beats_input_codec_plain_applied"]}

Offset: 653646 Key: Timestamp: 2025-12-10 03:59:58.324 Headers: empty

{"@version":"1","event":{"hash":"17e467cbb9dbc34705ea9314a476e44949cb75c4002b2c0203eaed20ad9e9b95"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339186.569785\tCrNgfr1AgUCqJOe6F5\t172.30.1.35\t61012\t172.30.1.254\t53\tudp\tdns\t0.029318\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:57.219Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":918638},"tags":["beats_input_codec_plain_applied"]}

Offset: 653647 Key: Timestamp: 2025-12-10 03:59:58.324 Headers: empty

{"@version":"1","event":{"hash":"131160e7dfa7d09e3f899ca0160b9997c11679e7379ca0ce0bc3f9f44ecb0a54"},"ecs":{"version":"1.6.0"},"message":"1765339195.419666\tC06wvYlWsHjIumk92\t172.30.1.12\t52988\t8.8.8.8\t53\tudp\t56824\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t174.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:57.662Z","host":{"name":"f6b540842a86"},"log":{"offset":914797,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653648 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"54d27b40072681732e3f383ac785acd2a0525fdc6a2b58e4d692f28b2f58b17e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339135.180591\tCtYoOa2iivq6oge2h2\t172.30.1.35\t53594\t8.8.8.8\t443\tudp\t-\t1.385950\t6438\t9275\tSF\tT\tF\t0\tDd\t19\t6970\t22\t9891\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:58.225Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":918769},"tags":["beats_input_codec_plain_applied"]}

Offset: 653649 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"a57e6be704dd8dfcc0647e1e1b5d8ba18addbf867bdbd2a7642a4686fb7f4627"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339187.041568\tCHGfFM3cmRnzYFywu8\t172.30.1.12\t35538\t8.8.8.8\t53\tudp\tdns\t0.029417\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:58.225Z","host":{"name":"f6b540842a86"},"log":{"offset":918902,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653650 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"645cdd7617bc85d4a0cba9a492ab50a0ce685218c92bf1968d24abfd94d03325"},"ecs":{"version":"1.6.0"},"message":"1765339196.381615\tCXaub42OaisS2FXnid\t172.30.1.12\t55624\t8.8.8.8\t53\tudp\t56825\t0.027517\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t136.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:58.672Z","host":{"name":"f6b540842a86"},"log":{"offset":914964,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653651 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"f87bfe4efc57bfd0cdf5934d0a2f67c309e48adc0d7b924bc207750fe2857cd9"},"ecs":{"version":"1.6.0"},"message":"1765339196.605345\tCMRbR54dyDs1ojkLx2\t172.30.1.35\t50649\t8.8.8.8\t53\tudp\t15446\t0.028098\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3265.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:58.673Z","host":{"name":"f6b540842a86"},"log":{"offset":915139,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653652 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"8e24467b0c6a7f377d5068307af22c6e65f2e8e03795d21932aa0363ca18a213"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339136.543442\tCpQ5rslvFw3COqtM9\t172.30.1.35\t63740\t142.250.204.206\t443\tudp\t-\t0.624390\t9379\t9379\tSF\tT\tF\t0\tDd\t16\t9827\t18\t9883\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:59.226Z","host":{"name":"f6b540842a86"},"log":{"offset":919026,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653653 Key: Timestamp: 2025-12-10 03:59:59.329 Headers: empty

{"@version":"1","event":{"hash":"ec5233ac69922bb476bea216066abec1f7bda68d1274863cc962089fdda68bf0"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339188.081541\tCcg6br1Xww2P4aR7gb\t172.30.1.12\t50632\t8.8.8.8\t53\tudp\tdns\t0.027322\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:59.226Z","host":{"name":"f6b540842a86"},"log":{"offset":919166,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653654 Key: Timestamp: 2025-12-10 04:00:00.780 Headers: empty

{"@version":"1","event":{"hash":"f47fbe1a826d1cc95b020b26eaff72c1c1b1f7a7a0702f843c355c92a960be2e"},"ecs":{"version":"1.6.0"},"message":"1765339197.437637\tCMleNC4ZvtmjZBqUdc\t172.30.1.12\t39243\t8.8.8.8\t53\tudp\t56826\t0.000477\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t221.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:59:59.677Z","host":{"name":"f6b540842a86"},"log":{"offset":915308,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653655 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"db18b2e2370b12eaa4b2a01c85407a3834eafe3d4a11e0a6563c97f73b5b9f3c"},"ecs":{"version":"1.6.0"},"message":"#unset_field\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":54,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653656 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"341a6e359e7d1291b830f6516b3851adc37871890315354f1c5e97f8e75876dc"},"ecs":{"version":"1.6.0"},"message":"#path\tdns","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"offset":69,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653657 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"a079b440dda0ac5dc5407e4a86084f84ed63fe05b31aa03181ab3ce820a7ad3b"},"ecs":{"version":"1.6.0"},"message":"#set_separator\t,","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":16,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653658 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"2c7b9ec50baee017bac07de96a966313094e35f7edee43fd0d32e70648caa291"},"ecs":{"version":"1.6.0"},"message":"#open\t2025-12-10-04-00-00","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":80,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653659 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"e8a8b2928a44bb739958a3b2b65a3c170be364be018b2f176b8f07f97d2ad024"},"ecs":{"version":"1.6.0"},"message":"#fields\tts\tuid\tid.orig_h\tid.orig_p\tid.resp_h\tid.resp_p\tproto\ttrans_id\trtt\tquery\tqclass\tqclass_name\tqtype\tqtype_name\trcode\trcode_name\tAA\tTC\tRD\tRA\tZ\tanswers\tTTLs\trejected","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":105},"tags":["beats_input_codec_plain_applied"]}

Offset: 653660 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"4b86875fd44536401745c0cdce211780a67232fd86c257ff845752e46fe8a235"},"ecs":{"version":"1.6.0"},"message":"#separator \\x09","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.825Z","host":{"name":"f6b540842a86"},"log":{"offset":0,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653661 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"21206b5cd0fcbea0cc1d60ff5aca8bb973971a8ccf342ee62acaecfe0d56e481"},"ecs":{"version":"1.6.0"},"message":"#path\tconn","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":69,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653662 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"2c7b9ec50baee017bac07de96a966313094e35f7edee43fd0d32e70648caa291"},"ecs":{"version":"1.6.0"},"message":"#open\t2025-12-10-04-00-00","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":79},"tags":["beats_input_codec_plain_applied"]}

Offset: 653663 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"4b86875fd44536401745c0cdce211780a67232fd86c257ff845752e46fe8a235"},"ecs":{"version":"1.6.0"},"message":"#separator \\x09","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":0,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653664 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"f55fa7c545af810ea713b2fd583033adadef4e5f22763934031e765830cc2a17"},"ecs":{"version":"1.6.0"},"message":"#types\tstring\ttime\tstring\taddr\tport\taddr\tport\tenum\tstring\tinterval\tcount\tcount\tstring\tbool\tbool\tcount\tstring\tcount\tcount\tcount\tcount\tset[string]","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":334,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653665 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"067cc2d4d60ba0f06714aefc5dc94ec6955cdac72a300386b0d3857f48535499"},"ecs":{"version":"1.6.0"},"message":"1765339199.481645\tClc7HY2new80iCwvOg\t172.30.1.12\t52689\t8.8.8.8\t53\tudp\t56828\t0.027661\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t133.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"offset":442,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653666 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"b4aa02572b1a6ba30e3cbf01c827b5727f37012d93078a62ce3efa511ce2e6cf"},"ecs":{"version":"1.6.0"},"message":"#empty_field\t(empty)","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":33,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653667 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"3a9106854b7cce7ba8ee203e540f30f6880557ed5a3c6e912126248ddac5e644"},"ecs":{"version":"1.6.0"},"message":"#fields\t_node_name\tts\tuid\tid.orig_h\tid.orig_p\tid.resp_h\tid.resp_p\tproto\tservice\tduration\torig_bytes\tresp_bytes\tconn_state\tlocal_orig\tlocal_resp\tmissed_bytes\thistory\torig_pkts\torig_ip_bytes\tresp_pkts\tresp_ip_bytes\ttunnel_parents","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":106,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653668 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"b67e88d216d2f12105cb821a6d73429d13726232758d017aee00d87b361f5c96"},"ecs":{"version":"1.6.0"},"message":"#types\ttime\tstring\taddr\tport\taddr\tport\tenum\tcount\tinterval\tstring\tcount\tstring\tcount\tstring\tcount\tstring\tbool\tbool\tbool\tbool\tcount\tvector[string]\tvector[interval]\tbool","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"offset":274,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653669 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"b4aa02572b1a6ba30e3cbf01c827b5727f37012d93078a62ce3efa511ce2e6cf"},"ecs":{"version":"1.6.0"},"message":"#empty_field\t(empty)","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":33,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653670 Key: Timestamp: 2025-12-10 04:00:03.934 Headers: empty

{"@version":"1","event":{"hash":"db18b2e2370b12eaa4b2a01c85407a3834eafe3d4a11e0a6563c97f73b5b9f3c"},"ecs":{"version":"1.6.0"},"message":"#unset_field\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":54,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653671 Key: Timestamp: 2025-12-10 04:00:03.935 Headers: empty

{"@version":"1","event":{"hash":"a079b440dda0ac5dc5407e4a86084f84ed63fe05b31aa03181ab3ce820a7ad3b"},"ecs":{"version":"1.6.0"},"message":"#set_separator\t,","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.826Z","host":{"name":"f6b540842a86"},"log":{"offset":16,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653672 Key: Timestamp: 2025-12-10 04:00:03.935 Headers: empty

{"@version":"1","event":{"hash":"71ca133c25f6b062f714c5f37162efa759c437f1e886b8e440973a803da954e9"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339190.151548\tChO9Ur1CGPaWKBaFn6\t172.30.1.12\t37801\t8.8.8.8\t53\tudp\tdns\t0.030137\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"offset":479,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653673 Key: Timestamp: 2025-12-10 04:00:03.935 Headers: empty

{"@version":"1","event":{"hash":"e73e3d8aea97012959f448ed06e5b65de77ee12fed626deb42dfcdbcfdb13344"},"ecs":{"version":"1.6.0"},"message":"1765339200.511685\tCjGe2l4gN0bKqp0hf3\t172.30.1.12\t43922\t8.8.8.8\t53\tudp\t56829\t0.026433\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t197.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:02.827Z","host":{"name":"f6b540842a86"},"log":{"offset":617,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653674 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"061e09f097ab5e313d7233c7bef6b1106f771a3515793ee8060866035a647c33"},"ecs":{"version":"1.6.0"},"message":"1765339201.602273\tCVUyCC3TXXVb26WG91\t172.30.1.35\t63278\t8.8.8.8\t53\tudp\t44552\t0.026770\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3260.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:03.828Z","host":{"name":"f6b540842a86"},"log":{"offset":960,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653675 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"a6468b1eb21da17167a3563171b007a46ee745732ae90a287cd64dff19670aee"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339191.605858\tCC4AGk1F0nDHR91qHj\t172.30.1.35\t52684\t8.8.8.8\t53\tudp\tdns\t0.027003\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:03.837Z","host":{"name":"f6b540842a86"},"log":{"offset":603,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653676 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"f5f52a4c4bfa12351c305ad80151d4638bbf2cc9ed4611491f5f2cd6e5a641a3"},"ecs":{"version":"1.6.0"},"message":"1765339201.605985\tCbs4L21thTq4ugCwgd\t172.30.1.12\t58476\t8.8.8.8\t53\tudp\t56830\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t273.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:03.827Z","host":{"name":"f6b540842a86"},"log":{"offset":792,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653677 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"26eab9a09fdb866ac37ad8145227352d201c62b36e2a022f81653786dd83a85c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339192.231573\tCi2R7CZu8CJXqBk9k\t172.30.1.12\t52650\t8.8.8.8\t53\tudp\tdns\t0.026957\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:03.838Z","host":{"name":"f6b540842a86"},"log":{"offset":853,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653678 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"a296654a3069e3679ac460cee1f966870e608bf3a1d49bd658770e142953f677"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765339191.192060\tCbAAL33bCl1q9G6rKb\t172.30.1.12\t46186\t8.8.8.8\t53\tudp\tdns\t0.027828\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:03.837Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":729},"tags":["beats_input_codec_plain_applied"]}

Offset: 653679 Key: Timestamp: 2025-12-10 04:00:04.941 Headers: empty

{"@version":"1","event":{"hash":"5449e19d386835807bfd64f5602aa214a48806f9708bd5042ba66f1efeea5df4"},"ecs":{"version":"1.6.0"},"message":"1765339202.571720\tC7KWNf4fdA5z8N8yad\t172.30.1.12\t37638\t8.8.8.8\t53\tudp\t56831\t0.030387\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t195.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:00:04.828Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":1129},"tags":["beats_input_codec_plain_applied"]}

Offset: 653680 Key: Timestamp: 2025-12-10 04:09:49.317 Headers: empty

{"@version":"1","event":{"hash":"4cd446eb720492fe837fa5dba8f9988e90136b48382a4c231b90b7386d06e775"},"ecs":{"version":"1.6.0"},"message":"1765339786.573031\tCI0l082SqDKn4gtZs2\t172.30.1.35\t49278\t172.30.1.254\t53\tudp\t59733\t0.014451\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t680.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:48.213Z","host":{"name":"f6b540842a86"},"log":{"offset":141651,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653681 Key: Timestamp: 2025-12-10 04:09:50.318 Headers: empty

{"@version":"1","event":{"hash":"4d238858440465f94f5f4bab0eb2a35290e3f9fe1402053246eeada8c86961f9"},"ecs":{"version":"1.6.0"},"message":"1765339786.768086\tCvVQIs3SbaPV5ft2e9\t172.30.1.12\t37879\t8.8.8.8\t53\tudp\t57398\t0.027708\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t183.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:49.214Z","host":{"name":"f6b540842a86"},"log":{"offset":141824,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653682 Key: Timestamp: 2025-12-10 04:09:50.318 Headers: empty

{"@version":"1","event":{"hash":"0c7d71307a5001b09bf36d8753aa13745a1f02691b24ea830594ae00d58dfe2d"},"ecs":{"version":"1.6.0"},"message":"1765339787.807379\tCguwl92ahTloySJHla\t172.30.1.12\t55194\t8.8.8.8\t53\tudp\t57399\t0.030034\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t231.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:49.214Z","host":{"name":"f6b540842a86"},"log":{"offset":141999,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653683 Key: Timestamp: 2025-12-10 04:09:50.318 Headers: empty

{"@version":"1","event":{"hash":"4b179939efe85a7a8d492e551589fad784412d590df46cce6d4581ee0636367d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339776.562039\tCrM53E3DXCxVnA5eq1\t172.30.1.35\t49707\t172.30.1.254\t53\tudp\tdns\t0.008420\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:49.420Z","host":{"name":"f6b540842a86"},"log":{"offset":145872,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653684 Key: Timestamp: 2025-12-10 04:09:50.318 Headers: empty

{"@version":"1","event":{"hash":"3a9e0f0a70b4a0b1bcd07f951fa12bf8f6a4bbbf561130ad27db5d1240186853"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765339776.437241\tCzqBLT2DvyjVBiGVjj\t172.30.1.12\t41028\t8.8.8.8\t53\tudp\tdns\t0.027215\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:49.420Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":145748},"tags":["beats_input_codec_plain_applied"]}

Offset: 653685 Key: Timestamp: 2025-12-10 04:09:50.318 Headers: empty

{"@version":"1","event":{"hash":"74ee7abf392a6fc37081efb88b9e67bd4a4a65f7401e7715acafd79953c53365"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765339777.467185\tCBvHVM1yCLS7d57xQj\t172.30.1.12\t59262\t8.8.8.8\t53\tudp\tdns\t0.027809\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:49.420Z","host":{"name":"f6b540842a86"},"log":{"offset":146003,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 653686 Key: Timestamp: 2025-12-10 04:09:51.321 Headers: empty

{"@version":"1","event":{"hash":"271f3eea072f26fe68360df74efca0e3fa76e43ffb55ffcc01ba1b4860f64e0c"},"ecs":{"version":"1.6.0"},"message":"1765339788.847334\tCmUQUd2zvwF3UMgBm6\t172.30.1.12\t59615\t8.8.8.8\t53\tudp\t57400\t0.027147\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t230.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:50.215Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":142174},"tags":["beats_input_codec_plain_applied"]}

Offset: 653687 Key: Timestamp: 2025-12-10 04:09:51.321 Headers: empty

{"@version":"1","event":{"hash":"109fa58e6a113c8be946f22e9b7899d8c2bad8c49cd2b6d5fc913cc9afc164ae"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765339778.497193\tCM6qlX3ooM9GBCxqX3\t172.30.1.12\t53636\t8.8.8.8\t53\tudp\tdns\t0.028808\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T04:09:50.421Z","host":{"name":"f6b540842a86"},"log":{"offset":146127,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network