Kafdrop: Topic: logstash-local-network: Messages

Offset: 637147 Key: Timestamp: 2025-12-09 03:27:20.030 Headers: empty

{"@version":"1","event":{"hash":"29698c885e5bec698b0df9c1b487aee5c91c9559ec54cf5bb2b0a6dd4ddc28db"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250827.274990\tCRfK4o4VdnqBUIdIzj\t172.30.1.12\t60720\t172.30.1.254\t53\tudp\tdns\t0.003266\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:19.315Z","host":{"name":"f6b540842a86"},"log":{"offset":495679,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637148 Key: Timestamp: 2025-12-09 03:27:20.030 Headers: empty

{"@version":"1","event":{"hash":"e550bb48f061246276d4e988a45c148df11f376496faa1c9c9efbd7a02d1e014"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250832.857990\tCOoTKx2ODKzCgdX3v8\t172.30.1.35\t64192\t172.30.2.17\t7680\ttcp\t-\t0.006705\t75\t0\tSF\tT\tT\t1\tShADgFfa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:19.315Z","host":{"name":"f6b540842a86"},"log":{"offset":495808,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637149 Key: Timestamp: 2025-12-09 03:27:20.030 Headers: empty

{"@version":"1","event":{"hash":"65fbccd9feda5026b9ee660f9e2d206435a21ce392fdcf812c25442f448b99d6"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250828.284931\tCyzeS92fsCgxRoHKej\t172.30.1.12\t54350\t172.30.1.254\t53\tudp\tdns\t0.003323\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:19.315Z","host":{"name":"f6b540842a86"},"log":{"offset":495943,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637150 Key: Timestamp: 2025-12-09 03:27:21.031 Headers: empty

{"@version":"1","event":{"hash":"089f5054addeca7ce60022bb1d17e1e9dc0ed73511ce7a2a8ec28c864472d051"},"ecs":{"version":"1.6.0"},"message":"1765250838.384991\tChTZtq3UtxuuXpDeQh\t172.30.1.12\t42165\t172.30.1.254\t53\tudp\t35593\t0.003367\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:19.928Z","host":{"name":"f6b540842a86"},"log":{"offset":409999,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637151 Key: Timestamp: 2025-12-09 03:27:22.033 Headers: empty

{"@version":"1","event":{"hash":"8bbd9818c29c6810aece5580854ed774838193bc317c78630556a0b9c6f75666"},"ecs":{"version":"1.6.0"},"message":"1765250839.410067\tCpDZQk2j0tLWY9si44\t172.30.1.12\t38245\t172.30.1.254\t53\tudp\t35594\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:20.929Z","host":{"name":"f6b540842a86"},"log":{"offset":410177,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637152 Key: Timestamp: 2025-12-09 03:27:23.034 Headers: empty

{"@version":"1","event":{"hash":"6c64dc449a3eda5b3057f1b41a02b0eacc5c30d7dd82210ab1381604a689f90a"},"ecs":{"version":"1.6.0"},"message":"1765250840.405290\tCpNfnt2vGhlYY7rYNi\t172.30.1.12\t47129\t172.30.1.254\t53\tudp\t35595\t0.003292\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:21.930Z","host":{"name":"f6b540842a86"},"log":{"offset":410348,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637153 Key: Timestamp: 2025-12-09 03:27:23.034 Headers: empty

{"@version":"1","event":{"hash":"352a2de23090af5ebd4cc05e543242d01f8c9aa661a15c1064f8c21c46959449"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250829.295034\tCTJUQpnGcO9gyC8Ql\t172.30.1.12\t46351\t172.30.1.254\t53\tudp\tdns\t0.003374\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:22.315Z","host":{"name":"f6b540842a86"},"log":{"offset":496072,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637154 Key: Timestamp: 2025-12-09 03:27:23.034 Headers: empty

{"@version":"1","event":{"hash":"dc8d08ecf83f5052648d515702b79e695e8ba6936d399ff64f333c594aad6592"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250830.305404\tCdtHuV2YffpxH6esMd\t172.30.1.12\t39930\t172.30.1.254\t53\tudp\tdns\t0.004086\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:22.315Z","host":{"name":"f6b540842a86"},"log":{"offset":496200,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637155 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"3b8e2016e9b68ca724c394e5b56a1c360b165aca080fa5df39e2f9929e455ed1"},"ecs":{"version":"1.6.0"},"message":"1765250841.433192\tCtsona2DohR5vxpDC6\t172.30.1.12\t51203\t172.30.1.254\t53\tudp\t35596\t0.000182\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:22.931Z","host":{"name":"f6b540842a86"},"log":{"offset":410526,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637156 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"0faa471e4394dc518af152b7d3c949b7688af9e5b870ed25772eb2898790937f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250831.314946\tCC12vb3bW0rhRjULt4\t172.30.1.12\t49656\t172.30.1.254\t53\tudp\tdns\t0.002818\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.316Z","host":{"name":"f6b540842a86"},"log":{"offset":496329,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637157 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"1daa66e781e82857301ada236a060e16bb71bdc27ac20f27282dc191b793f333"},"ecs":{"version":"1.6.0"},"message":"1765250841.803475\tCbnjP53oeSFNzylJRd\t172.30.1.35\t58202\t8.8.8.8\t53\tudp\t23669\t0.018240\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3453.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:22.931Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":410704},"tags":["beats_input_codec_plain_applied"]}

Offset: 637158 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"7e33448b7b8f91641124512b08481645a40f252819dd97fabfa87c2381da0799"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250836.709036\tCqWXl344eQSiST1dic\t172.30.1.2\t33318\t172.30.4.139\t1514\ttcp\t-\t2.998882\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.317Z","host":{"name":"f6b540842a86"},"log":{"offset":496458,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637159 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"a7785488bbb70ae07d4f5f394037ebdee67343102e6c1b4705daebcf458c4c8a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250836.574034\tCq62X311NBtwjzc002\t10.10.10.1\t52308\t10.10.10.202\t8000\ttcp\t-\t3.014718\t32\t0\tS0\tT\tT\t0\tSAD\t25\t1340\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.317Z","host":{"name":"f6b540842a86"},"log":{"offset":496583,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637160 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"e6578e121bbd413b34bc4df366397e3cbec5cddbbb02aa8cd9286ce69ae0be6a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250831.764115\tCcIwX51fu3FvhZpUu7\t172.30.1.35\t50673\t172.30.1.254\t53\tudp\tdns\t0.005541\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.317Z","host":{"name":"f6b540842a86"},"log":{"offset":496713,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637161 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"8b6d57178165f8b0bc7c9cbfd8ace66b623b75e4e5714c8f95bcca875a82ce0a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250338.095837\tCH93WL1NeewGXLClhb\t10.10.10.1\t52212\t10.10.10.202\t8000\ttcp\t-\t498.816597\t0\t0\tOTH\tT\tT\t0\tAFR\t331\t17332\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.317Z","host":{"name":"f6b540842a86"},"log":{"offset":496844,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637162 Key: Timestamp: 2025-12-09 03:27:24.035 Headers: empty

{"@version":"1","event":{"hash":"4cbb70f26d257273d1ea7bf933fbdb7b6e3229ff3d38ba2745da8234e0bf7f86"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250832.325132\tCViEed4ukCYxH3WL1k\t172.30.1.12\t34482\t172.30.1.254\t53\tudp\tdns\t0.002815\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.317Z","host":{"name":"f6b540842a86"},"log":{"offset":496978,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637163 Key: Timestamp: 2025-12-09 03:27:25.036 Headers: empty

{"@version":"1","event":{"hash":"19d4c25b2b254dff09dc33483b2ca987af17559f8936f54519276f4589ac3e5c"},"ecs":{"version":"1.6.0"},"message":"1765250842.427368\tCcOEoQ2N35ufGFttT3\t172.30.1.12\t47439\t172.30.1.254\t53\tudp\t35597\t0.000539\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.932Z","host":{"name":"f6b540842a86"},"log":{"offset":410873,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637164 Key: Timestamp: 2025-12-09 03:27:25.036 Headers: empty

{"@version":"1","event":{"hash":"aa1ab4e1c5f114edadd330cb4f6c521ebd5a03e3fbe91ad16b70e1e10b1f66f5"},"ecs":{"version":"1.6.0"},"message":"1765250841.755614\tCkPuIT39VmOtIAqxw2\t172.30.1.35\t58202\t172.30.1.254\t53\tudp\t23669\t0.739013\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3479.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:23.932Z","host":{"name":"f6b540842a86"},"log":{"offset":411051,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637165 Key: Timestamp: 2025-12-09 03:27:26.037 Headers: empty

{"@version":"1","event":{"hash":"fd0d1463215e66aa7dae21e5c18bf10cdcb442ebee3ca6fd6adb07c304647771"},"ecs":{"version":"1.6.0"},"message":"1765250843.435094\tCbHg5fuFQCBqCkjd4\t172.30.1.12\t51010\t172.30.1.254\t53\tudp\t35598\t0.003422\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:24.932Z","host":{"name":"f6b540842a86"},"log":{"offset":411225,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637166 Key: Timestamp: 2025-12-09 03:27:26.037 Headers: empty

{"@version":"1","event":{"hash":"a80cccbbdcfdb5f7ede581b1a4798cedc761c8e779d72f8acc42fe526c1c3c1a"},"ecs":{"version":"1.6.0"},"message":"1765250844.453487\tCLCJ2C2izm8uf343m9\t172.30.1.12\t50996\t172.30.1.254\t53\tudp\t35599\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:25.933Z","host":{"name":"f6b540842a86"},"log":{"offset":411402,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637167 Key: Timestamp: 2025-12-09 03:27:27.426 Headers: empty

{"@version":"1","event":{"hash":"301f7c5845ca81e5c2f1d459b822f08f8f4334467e86a089f9a648c813c6d2b7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250755.550489\tCLQiHy4BKYQlOVxLna\t172.30.1.35\t61396\t8.8.4.4\t443\tudp\t-\t28.308381\t6251\t7721\tSF\tT\tF\t0\tDd\t17\t6727\t22\t8337\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:26.317Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":497236},"tags":["beats_input_codec_plain_applied"]}

Offset: 637168 Key: Timestamp: 2025-12-09 03:27:27.426 Headers: empty

{"@version":"1","event":{"hash":"dd002478e96ea9793ddbb8a8a5c6f300fa3a9aa085ce3828d22aa1ec92991010"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250833.334957\tCS5SYW31xzErNN1X02\t172.30.1.12\t54109\t172.30.1.254\t53\tudp\tdns\t0.002992\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:26.317Z","host":{"name":"f6b540842a86"},"log":{"offset":497107,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637169 Key: Timestamp: 2025-12-09 03:27:27.426 Headers: empty

{"@version":"1","event":{"hash":"461b9c4200f8c17f71bc103961601bcf07c6584c235692a5c62bb8e41b9f989d"},"ecs":{"version":"1.6.0"},"message":"1765250845.455104\tCRUx1S2OlmUotaXU8l\t172.30.1.12\t42661\t172.30.1.254\t53\tudp\t35600\t0.003191\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:26.934Z","host":{"name":"f6b540842a86"},"log":{"offset":411573,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637170 Key: Timestamp: 2025-12-09 03:27:27.426 Headers: empty

{"@version":"1","event":{"hash":"98d1dab9c881c85a082852ef1de13633407b102a23d976fef1b0227a3ddaefce"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250834.345112\tCaO0UyRJXVmeZKVhj\t172.30.1.12\t35143\t172.30.1.254\t53\tudp\tdns\t0.002912\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:26.317Z","host":{"name":"f6b540842a86"},"log":{"offset":497510,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637171 Key: Timestamp: 2025-12-09 03:27:27.427 Headers: empty

{"@version":"1","event":{"hash":"dee08389079ce8ce5cd0ac2579218d1bced8bd85bf6133fa853010c0a7a25fb1"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250783.819345\tCpI6UL3KtjJXZoxjfb\t172.30.1.35\t60576\t172.217.194.95\t443\tudp\t-\t0.093649\t4910\t7026\tSF\tT\tF\t0\tDd\t10\t5190\t12\t7362\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:26.317Z","host":{"name":"f6b540842a86"},"log":{"offset":497370,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637172 Key: Timestamp: 2025-12-09 03:27:28.428 Headers: empty

{"@version":"1","event":{"hash":"7a443b7b41a66b140aa47fa8156166e941532d308d296de220574c0c7c13ba3e"},"ecs":{"version":"1.6.0"},"message":"1765250845.458635\tCd0jFg4i3u4EiJ4vz\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\t0\t0.909280\tpower-consumption-ssc.local\t32769\tqclass-32769\t255\t*\t0\tNOERROR\tT\tF\tF\tF\t0\t_esphomelib._tcp.local,power-consumption-ssc._esphomelib._tcp.local,power-consumption-ssc.local,TXT 51 api_encryption=Noise_NNpsk0_25519_ChaChaPoly_SHA256 TXT 12 network=wifi TXT 24 board=ttgo-t7-v14-mini32 TXT 14 platform=ESP32 TXT 16 mac=0cb8151ae720 TXT 16 version=2023.6.5 TXT 35 friendly_name=Power-Consumption-SSC,172.30.1.65\t4500.000000,4500.000000,120.000000,4500.000000,120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:27.934Z","host":{"name":"f6b540842a86"},"log":{"offset":411751,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637173 Key: Timestamp: 2025-12-09 03:27:28.428 Headers: empty

{"@version":"1","event":{"hash":"0c7cbc862585a4eaa2251c1dd02f11d671bd0886fe835603be36c71d4f906d14"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250835.355128\tCsbmZS2OFPWJZSU0v3\t172.30.1.12\t51153\t172.30.1.254\t53\tudp\tdns\t0.002864\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:27.324Z","host":{"name":"f6b540842a86"},"log":{"offset":497638,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637174 Key: Timestamp: 2025-12-09 03:27:28.428 Headers: empty

{"@version":"1","event":{"hash":"338d5b7ec25687b17448f488edf431864e6357342d81da420eeef233896cd185"},"ecs":{"version":"1.6.0"},"message":"1765250846.803157\tCi6Rr329oVIA9W9Rsh\t172.30.1.35\t60843\t8.8.8.8\t53\tudp\t25462\t0.027578\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t846.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:27.934Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":412301},"tags":["beats_input_codec_plain_applied"]}

Offset: 637175 Key: Timestamp: 2025-12-09 03:27:28.428 Headers: empty

{"@version":"1","event":{"hash":"ceabb711c2c8294bd17f37193d35b3efe7247385c3d3a448ddd8539a4995dfef"},"ecs":{"version":"1.6.0"},"message":"1765250846.465048\tCLoXgE19JSYMXvkPy\t172.30.1.12\t54096\t172.30.1.254\t53\tudp\t35601\t0.003194\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:27.934Z","host":{"name":"f6b540842a86"},"log":{"offset":412469,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637176 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"f94c0130deecf0b56cfbcb48425ce3c8d1dd8a56efcd7c574741f090dc514dc3"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250836.365000\tCPV9oG1YXIl2xMBwtl\t172.30.1.12\t49653\t172.30.1.254\t53\tudp\tdns\t0.003187\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.325Z","host":{"name":"f6b540842a86"},"log":{"offset":497767,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637177 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"c5360fed48a6adeb7fbba11b56885e62c19817ac821f9b5943fd2b76c29901db"},"ecs":{"version":"1.6.0"},"message":"1765250846.764312\tCPCnz82ktuL1ZIIVJ7\t172.30.1.35\t60843\t172.30.1.254\t53\tudp\t25462\t0.620073\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3474.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.934Z","host":{"name":"f6b540842a86"},"log":{"offset":412646,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637178 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"94e7d3b1efa6d759540a5b59e55bbb9f7327db2e6930a3b2a300a58f0e8890b3"},"ecs":{"version":"1.6.0"},"message":"1765250847.475976\tC82lUPv2Dtn0fi8ud\t172.30.1.12\t53357\t172.30.1.254\t53\tudp\t35602\t0.004774\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.935Z","host":{"name":"f6b540842a86"},"log":{"offset":412820,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637179 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"dc14f33f5c6f13098b015c0c2296db22e1d5328a16b46d16d57a6767e3f37713"},"ecs":{"version":"1.6.0"},"message":"1765250845.794177\tCd0jFg4i3u4EiJ4vz\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\t0\t1.669651\tpower-consumption-ssc.local\t1\tC_INTERNET\t255\t*\t0\tNOERROR\tT\tF\tF\tF\t0\t_esphomelib._tcp.local,power-consumption-ssc._esphomelib._tcp.local,power-consumption-ssc.local,TXT 51 api_encryption=Noise_NNpsk0_25519_ChaChaPoly_SHA256 TXT 12 network=wifi TXT 24 board=ttgo-t7-v14-mini32 TXT 14 platform=ESP32 TXT 16 mac=0cb8151ae720 TXT 16 version=2023.6.5 TXT 35 friendly_name=Power-Consumption-SSC,172.30.1.65\t4500.000000,4500.000000,120.000000,4500.000000,120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.935Z","host":{"name":"f6b540842a86"},"log":{"offset":412997,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637180 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"6560016f43ee4b766f8313132bfdb3249f8bd04705f83a9c0b9479e75b3d3713"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250837.375044\tC7sfAP3h0Xsq2qxEhj\t172.30.1.12\t59151\t172.30.1.254\t53\tudp\tdns\t0.003266\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.325Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":497896},"tags":["beats_input_codec_plain_applied"]}

Offset: 637181 Key: Timestamp: 2025-12-09 03:27:29.429 Headers: empty

{"@version":"1","event":{"hash":"f843d3fe7b2349b6d77a42aae0c9552080eb84b82ee136bb86771d64d358bcdb"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250836.759996\tCyTr8s2IeK4ARNIyac\t172.30.1.35\t58757\t172.30.1.254\t53\tudp\tdns\t0.025054\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:28.325Z","host":{"name":"f6b540842a86"},"log":{"offset":498025,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637182 Key: Timestamp: 2025-12-09 03:27:30.431 Headers: empty

{"@version":"1","event":{"hash":"5f3adfa49c43a8db205fc0e6733acc441b22699892cff115e23cc36e8119da5c"},"ecs":{"version":"1.6.0"},"message":"1765250848.525916\tC19Cpv1yB1lCCirTY9\t172.30.1.12\t47110\t172.30.1.254\t53\tudp\t35603\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:29.935Z","host":{"name":"f6b540842a86"},"log":{"offset":413541,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637183 Key: Timestamp: 2025-12-09 03:27:30.431 Headers: empty

{"@version":"1","event":{"hash":"c996235ca80c99e99bb6d75b6d4c04c88c93277166804dd894d73a9f60fb3fa4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250838.384991\tChTZtq3UtxuuXpDeQh\t172.30.1.12\t42165\t172.30.1.254\t53\tudp\tdns\t0.003367\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:29.325Z","host":{"name":"f6b540842a86"},"log":{"offset":498156,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637184 Key: Timestamp: 2025-12-09 03:27:32.039 Headers: empty

{"@version":"1","event":{"hash":"82cece9b3d5a25ca9c6f5f70b654e41496bc1dc5a182ac0f5b5d8e3e70de6ab2"},"ecs":{"version":"1.6.0"},"message":"1765250849.508173\tCQWx6a1aW6rTKgdife\t172.30.1.12\t50105\t172.30.1.254\t53\tudp\t35604\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:30.936Z","host":{"name":"f6b540842a86"},"log":{"offset":413712,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637185 Key: Timestamp: 2025-12-09 03:27:33.043 Headers: empty

{"@version":"1","event":{"hash":"abb5dab6562429f4385e6a67b3308fb19df689730b8269d0e67e8cb61617ce78"},"ecs":{"version":"1.6.0"},"message":"1765250851.525010\tCWehQt3a3MTciXSoi\t172.30.1.12\t35302\t172.30.1.254\t53\tudp\t35606\t0.004975\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:31.937Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":414061},"tags":["beats_input_codec_plain_applied"]}

Offset: 637186 Key: Timestamp: 2025-12-09 03:27:33.043 Headers: empty

{"@version":"1","event":{"hash":"67933a4d4824ec540f9f3da302d5a7215d46a12a7dcb8d69a04b235caefbcd6f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250839.395029\tCpDZQk2j0tLWY9si44\t172.30.1.12\t38245\t172.30.1.254\t53\tudp\tdns\t0.003399\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:32.333Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":498285},"tags":["beats_input_codec_plain_applied"]}

Offset: 637187 Key: Timestamp: 2025-12-09 03:27:33.043 Headers: empty

{"@version":"1","event":{"hash":"0bf807d7e355444ec6a577de1627ce2aa842657ad0e47a1720ea55f9cc7dfeb7"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250840.405290\tCpNfnt2vGhlYY7rYNi\t172.30.1.12\t47129\t172.30.1.254\t53\tudp\tdns\t0.003292\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:32.333Z","host":{"name":"f6b540842a86"},"log":{"offset":498414,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637188 Key: Timestamp: 2025-12-09 03:27:33.043 Headers: empty

{"@version":"1","event":{"hash":"5dc0ef0855eeaf9923d98a2f9b30abdb9e84d9aabcd0c3c47a0cfea0c6539ee7"},"ecs":{"version":"1.6.0"},"message":"1765250850.510727\tCQvvmR1mSGjTFfS3Z6\t172.30.1.12\t57243\t172.30.1.254\t53\tudp\t35605\t0.002898\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:31.937Z","host":{"name":"f6b540842a86"},"log":{"offset":413883,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637189 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"e97adff4125b4e54e73fbf974941a8ea898b68bd19a279723c1734ef006afd26"},"ecs":{"version":"1.6.0"},"message":"1765250852.538069\tCBe0Q04rKHa0wZSNjj\t172.30.1.12\t39083\t172.30.1.254\t53\tudp\t35607\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:32.941Z","host":{"name":"f6b540842a86"},"log":{"offset":414405,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637190 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"4b1de8853c70327536586a01a468143c01856dba4cd5f5b1ef55a0f1a88787ae"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250846.675751\tCm6NlD3nlXBAHYHK83\t172.30.1.2\t40992\t172.30.4.136\t5044\ttcp\t-\t2.992087\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:33.342Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":498672},"tags":["beats_input_codec_plain_applied"]}

Offset: 637191 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"00bcb1989d71c5adb46e4b49902000192c97fbd8602316478f4a0f98c091cf01"},"ecs":{"version":"1.6.0"},"message":"1765250851.779986\tCkmC062woGSh5B68Jb\t172.30.1.35\t55848\t172.30.1.254\t53\tudp\t16664\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3470.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:32.941Z","host":{"name":"f6b540842a86"},"log":{"offset":414238,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637192 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"ed6b8d9ddd7104ccd78ddde87c29f2e8d8bc685b3fd17f82fa5c0a5a382e1838"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250841.433192\tCtsona2DohR5vxpDC6\t172.30.1.12\t51203\t172.30.1.254\t53\tudp\tdns\t0.000182\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:33.342Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":498543},"tags":["beats_input_codec_plain_applied"]}

Offset: 637193 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"c4ec5f8d71741ebb1c2ff2587770513f5a132c6d68e08782135da0a16a4f498a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250841.755614\tCkPuIT39VmOtIAqxw2\t172.30.1.35\t58202\t172.30.1.254\t53\tudp\tdns\t0.739013\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:33.342Z","host":{"name":"f6b540842a86"},"log":{"offset":498797,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637194 Key: Timestamp: 2025-12-09 03:27:34.047 Headers: empty

{"@version":"1","event":{"hash":"3645e6fcbbb93a8336963a7eb3b4b16b26408b23f262b917f8fe9dc53c11fb3b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250841.803475\tCbnjP53oeSFNzylJRd\t172.30.1.35\t58202\t8.8.8.8\t53\tudp\tdns\t0.018240\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:33.342Z","host":{"name":"f6b540842a86"},"log":{"offset":498928,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637195 Key: Timestamp: 2025-12-09 03:27:35.447 Headers: empty

{"@version":"1","event":{"hash":"f4f3fd9253a68e00ffb9afeec3c127408eb881d15476867dd00c8f8e15074466"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250843.435094\tCbHg5fuFQCBqCkjd4\t172.30.1.12\t51010\t172.30.1.254\t53\tudp\tdns\t0.003422\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:34.343Z","host":{"name":"f6b540842a86"},"log":{"offset":499183,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637196 Key: Timestamp: 2025-12-09 03:27:35.447 Headers: empty

{"@version":"1","event":{"hash":"6b2d13b7745be7dc18423f9f130d02858cb59d8917062060a116d0992ee94e30"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250842.427368\tCcOEoQ2N35ufGFttT3\t172.30.1.12\t47439\t172.30.1.254\t53\tudp\tdns\t0.000539\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:34.343Z","host":{"name":"f6b540842a86"},"log":{"offset":499054,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637197 Key: Timestamp: 2025-12-09 03:27:37.056 Headers: empty

{"@version":"1","event":{"hash":"f8e83e2e9e1bb0f34c162799c86d40c49ffe8def67f8857f5f66f49d96c5023c"},"ecs":{"version":"1.6.0"},"message":"1765250853.545125\tClFrU2daUssSioF4i\t172.30.1.12\t33563\t172.30.1.254\t53\tudp\t35608\t0.002812\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:35.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":414576},"tags":["beats_input_codec_plain_applied"]}

Offset: 637198 Key: Timestamp: 2025-12-09 03:27:37.056 Headers: empty

{"@version":"1","event":{"hash":"f3edebb02be01ce51c77d703b93f20b5c796b7c17c309f21044439e60946f0ea"},"ecs":{"version":"1.6.0"},"message":"1765250855.564889\tCFvEiC1ODUrglcsQs\t172.30.1.12\t40829\t172.30.1.254\t53\tudp\t35610\t0.003402\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:35.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":414931},"tags":["beats_input_codec_plain_applied"]}

Offset: 637199 Key: Timestamp: 2025-12-09 03:27:37.056 Headers: empty

{"@version":"1","event":{"hash":"094e3bec524af23c49c4eb3e34cac1b9e240b7a17305f63505f441add1873755"},"ecs":{"version":"1.6.0"},"message":"1765250854.554943\tC8NW7P1nvd8knmLrM7\t172.30.1.12\t51019\t172.30.1.254\t53\tudp\t35609\t0.003290\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:35.952Z","host":{"name":"f6b540842a86"},"log":{"offset":414753,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637200 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"0efe5a8e2e2d7467877c6874f1fc5b80147b96e1f56f64d00da33c2544bc64e0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250845.455104\tCRUx1S2OlmUotaXU8l\t172.30.1.12\t42661\t172.30.1.254\t53\tudp\tdns\t0.003191\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.344Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":499564},"tags":["beats_input_codec_plain_applied"]}

Offset: 637201 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"db53b5a7bf344935c177160a71760189aa753e485b9e887f4c8966576b3f091a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250849.713821\tCk3FqI7lGY8Z8uef5\t172.30.1.2\t33322\t172.30.4.139\t1514\ttcp\t-\t2.996014\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.344Z","host":{"name":"f6b540842a86"},"log":{"offset":499440,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637202 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"a533bd1c75f4ea784d88bc4126ff70e4322f00b4b82fbbc92775b28bc4640640"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250846.465048\tCLoXgE19JSYMXvkPy\t172.30.1.12\t54096\t172.30.1.254\t53\tudp\tdns\t0.003194\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.344Z","host":{"name":"f6b540842a86"},"log":{"offset":499693,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637203 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"d11c2dad752eb29fa4d1f91d235d7f40fabb04f90617e677a64ebf9ea03d9ea5"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250850.733378\tCZkppO37bkBPz6qTqi\t10.10.10.1\t52308\t10.10.10.202\t8000\ttcp\t-\t0.004230\t0\t0\tSH\tT\tT\t0\tAF\t5\t296\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.344Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":499821},"tags":["beats_input_codec_plain_applied"]}

Offset: 637204 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"d4dcb894489136c1100324c188ca81513bb6e2736b529883e5e5705df5dcb09d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250850.742124\tCH84022WnjyoscIHMa\t10.10.10.1\t52310\t10.10.10.202\t8000\ttcp\t-\t2.646431\t32\t0\tS0\tT\tT\t0\tSAD\t20\t1080\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.344Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":499947},"tags":["beats_input_codec_plain_applied"]}

Offset: 637205 Key: Timestamp: 2025-12-09 03:27:38.450 Headers: empty

{"@version":"1","event":{"hash":"e07c3bbad216b88450c61dbc768e58c52bbc0cca3f4f5786b10d41c92a858e63"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250844.445098\tCLCJ2C2izm8uf343m9\t172.30.1.12\t50996\t172.30.1.254\t53\tudp\tdns\t0.002977\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:37.343Z","host":{"name":"f6b540842a86"},"log":{"offset":499311,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637206 Key: Timestamp: 2025-12-09 03:27:39.455 Headers: empty

{"@version":"1","event":{"hash":"5fa9700cab8ab457c17e51c09bd975467055d584b942eb6a2d69485a10b8a2f7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250846.764312\tCPCnz82ktuL1ZIIVJ7\t172.30.1.35\t60843\t172.30.1.254\t53\tudp\tdns\t0.620073\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:38.351Z","host":{"name":"f6b540842a86"},"log":{"offset":500077,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637207 Key: Timestamp: 2025-12-09 03:27:39.455 Headers: empty

{"@version":"1","event":{"hash":"fb289ae4fcc6c90167bb0cabab36d55db967c55fd2d0c7c26a9b2f44e8b9d608"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250846.803157\tCi6Rr329oVIA9W9Rsh\t172.30.1.35\t60843\t8.8.8.8\t53\tudp\tdns\t0.027578\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:38.352Z","host":{"name":"f6b540842a86"},"log":{"offset":500208,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637208 Key: Timestamp: 2025-12-09 03:27:39.456 Headers: empty

{"@version":"1","event":{"hash":"12b2e23988ee1f5220c8cf22cf055b387734d37797e8d0a2a242e4e472653774"},"ecs":{"version":"1.6.0"},"message":"1765250856.626665\tCDRuiK2TQz06XlbiMa\t172.30.1.12\t33526\t172.30.1.254\t53\tudp\t35611\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:38.953Z","host":{"name":"f6b540842a86"},"log":{"offset":415108,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637209 Key: Timestamp: 2025-12-09 03:27:39.456 Headers: empty

{"@version":"1","event":{"hash":"aefdb5d1d7601ee8a41cf2df594482f2a4381a7dd15d48dab52f6cffc713f584"},"ecs":{"version":"1.6.0"},"message":"1765250856.750089\tCgIqDC3vaJ2bFtO494\t172.30.1.35\t56642\t172.30.1.254\t53\tudp\t19350\t0.004738\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3465.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:38.953Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":415279},"tags":["beats_input_codec_plain_applied"]}

Offset: 637210 Key: Timestamp: 2025-12-09 03:27:39.456 Headers: empty

{"@version":"1","event":{"hash":"8f64441e7d40a64ad7bce4361b109a5f48c1d762acf681936294854966bc80cb"},"ecs":{"version":"1.6.0"},"message":"1765250857.585294\tCYm3T52QqNz40GGnq3\t172.30.1.12\t51807\t172.30.1.254\t53\tudp\t35612\t0.003148\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:38.953Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":415453},"tags":["beats_input_codec_plain_applied"]}

Offset: 637211 Key: Timestamp: 2025-12-09 03:27:40.456 Headers: empty

{"@version":"1","event":{"hash":"c609b441952777e6ca6f92e32e03c711918ae894844572d737a8a92e4a4c8f70"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250847.475976\tC82lUPv2Dtn0fi8ud\t172.30.1.12\t53357\t172.30.1.254\t53\tudp\tdns\t0.004774\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:39.353Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":500334},"tags":["beats_input_codec_plain_applied"]}

Offset: 637212 Key: Timestamp: 2025-12-09 03:27:40.456 Headers: empty

{"@version":"1","event":{"hash":"12453c4196404b65de091725083bdaf7576ac286f7669926ecc803fa3f3fac08"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250797.658689\tCskHo51y9uzgsq20h7\t172.30.1.132\t3\t172.30.1.254\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tT\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:39.353Z","host":{"name":"f6b540842a86"},"log":{"offset":500462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637213 Key: Timestamp: 2025-12-09 03:27:40.456 Headers: empty

{"@version":"1","event":{"hash":"df2f8a73153048761b2fc8b5ddc7f185c6d229998874c6d9ac26e29996456989"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250848.485138\tC19Cpv1yB1lCCirTY9\t172.30.1.12\t47110\t172.30.1.254\t53\tudp\tdns\t0.003301\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:39.353Z","host":{"name":"f6b540842a86"},"log":{"offset":500576,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637214 Key: Timestamp: 2025-12-09 03:27:40.456 Headers: empty

{"@version":"1","event":{"hash":"a769f4110991653136437b1a31425ca4664658e8349d1f39b23481fc7f83d386"},"ecs":{"version":"1.6.0"},"message":"1765250858.595155\tCp4hDh25KV9HslbMM5\t172.30.1.12\t35127\t172.30.1.254\t53\tudp\t35613\t0.003443\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:39.953Z","host":{"name":"f6b540842a86"},"log":{"offset":415631,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637215 Key: Timestamp: 2025-12-09 03:27:41.458 Headers: empty

{"@version":"1","event":{"hash":"e16c6820f118f286ceeac11bd50496fb45cacf65be420422d4d7de9e2227c127"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250853.784203\tCI0xeU2Y44SQZdthbk\t172.30.1.63\t49754\t172.30.2.171\t5044\ttcp\t-\t4.098863\t0\t0\tS0\tT\tT\t0\tS\t5\t300\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:40.354Z","host":{"name":"f6b540842a86"},"log":{"offset":500705,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637216 Key: Timestamp: 2025-12-09 03:27:41.458 Headers: empty

{"@version":"1","event":{"hash":"c1b0b8e496274ffdeec2d045070878d6e96e124b183e685b9c829d52d8e1f329"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250849.495194\tCQWx6a1aW6rTKgdife\t172.30.1.12\t50105\t172.30.1.254\t53\tudp\tdns\t0.003287\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:40.354Z","host":{"name":"f6b540842a86"},"log":{"offset":500831,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637217 Key: Timestamp: 2025-12-09 03:27:41.458 Headers: empty

{"@version":"1","event":{"hash":"8fd8a49199f10f064b9c65ad2c7d3bc97a416e501d8ff151d5b67d36dcc0b0bc"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250850.510727\tCQvvmR1mSGjTFfS3Z6\t172.30.1.12\t57243\t172.30.1.254\t53\tudp\tdns\t0.002898\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:41.354Z","host":{"name":"f6b540842a86"},"log":{"offset":500960,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637218 Key: Timestamp: 2025-12-09 03:27:41.458 Headers: empty

{"@version":"1","event":{"hash":"9bb7373b41c05029b099aace58155a3e319dcce2037f63b4a01de8ecd51a6764"},"ecs":{"version":"1.6.0"},"message":"1765250859.604950\tCWu3il3iiE0MSDDHJh\t172.30.1.12\t54190\t172.30.1.254\t53\tudp\t35614\t0.003475\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:40.954Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":415809},"tags":["beats_input_codec_plain_applied"]}

Offset: 637219 Key: Timestamp: 2025-12-09 03:27:43.058 Headers: empty

{"@version":"1","event":{"hash":"3db31cdbb5e989372dd02b6fbd7ff50d470b3103eeb8b6a1ff1b9bfdb353b2c2"},"ecs":{"version":"1.6.0"},"message":"1765250861.624962\tCaJu9D1HsbkVrZ5jO3\t172.30.1.12\t42520\t172.30.1.254\t53\tudp\t35616\t0.003063\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:41.954Z","host":{"name":"f6b540842a86"},"log":{"offset":416158,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637220 Key: Timestamp: 2025-12-09 03:27:43.058 Headers: empty

{"@version":"1","event":{"hash":"53a27883f6718d412738cdf372b8ac8a852f7da6e2eaa85411e821ca70a1556a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250851.525010\tCWehQt3a3MTciXSoi\t172.30.1.12\t35302\t172.30.1.254\t53\tudp\tdns\t0.004975\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:42.354Z","host":{"name":"f6b540842a86"},"log":{"offset":501089,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637221 Key: Timestamp: 2025-12-09 03:27:43.058 Headers: empty

{"@version":"1","event":{"hash":"3be080e3c75d8b11f9f8ed9bbccf3415ec1bc1754dfabc0673e83eb88c034201"},"ecs":{"version":"1.6.0"},"message":"1765250860.661362\tCvBlUo3oui9z1e11ob\t172.30.1.12\t44147\t172.30.1.254\t53\tudp\t35615\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:41.954Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":415987},"tags":["beats_input_codec_plain_applied"]}

Offset: 637222 Key: Timestamp: 2025-12-09 03:27:44.060 Headers: empty

{"@version":"1","event":{"hash":"f11bafe884947ce3b8bd268b5ef42b4630e0cf58532891d51857ff973752cdbf"},"ecs":{"version":"1.6.0"},"message":"1765250861.753124\tCjqSLt1Lky2EfpiTj2\t172.30.1.35\t52884\t172.30.1.254\t53\tudp\t52179\t0.004887\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3460.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:42.956Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":416336},"tags":["beats_input_codec_plain_applied"]}

Offset: 637223 Key: Timestamp: 2025-12-09 03:27:44.060 Headers: empty

{"@version":"1","event":{"hash":"5eba2d5a82ec24a0aae8378c95f5fea5fa7b7a410d1b4861b5e7f2ed378ec2fe"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250852.538069\tCBe0Q04rKHa0wZSNjj\t172.30.1.12\t39083\t172.30.1.254\t53\tudp\tdns\t0.001142\t44\t60\tSF\tT\tT\t0\t^dD\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:43.356Z","host":{"name":"f6b540842a86"},"log":{"offset":501217,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637224 Key: Timestamp: 2025-12-09 03:27:44.060 Headers: empty

{"@version":"1","event":{"hash":"2ced91419e1dfe59851f6c94a74bddd2b3705489a21faa3f5be89ed4823dc54e"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250851.757941\tCkmC062woGSh5B68Jb\t172.30.1.35\t55848\t172.30.1.254\t53\tudp\tdns\t0.005136\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:43.356Z","host":{"name":"f6b540842a86"},"log":{"offset":501347,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637225 Key: Timestamp: 2025-12-09 03:27:45.068 Headers: empty

{"@version":"1","event":{"hash":"93c3b24c5018873543777401a36ba03e2ccd781ddbda94b864ffb683e13d2360"},"ecs":{"version":"1.6.0"},"message":"1765250862.702417\tCxMEs93YOVWaAveoZ8\t172.30.1.12\t48385\t172.30.1.254\t53\tudp\t35617\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:43.957Z","host":{"name":"f6b540842a86"},"log":{"offset":416510,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637226 Key: Timestamp: 2025-12-09 03:27:45.068 Headers: empty

{"@version":"1","event":{"hash":"aaf68ab98db1e2d48228ffc56bce92ed8a5139d2290189d2d6f219d3841610ec"},"ecs":{"version":"1.6.0"},"message":"1765250863.555044\tCRMB6v1gFPfDT2gEwd\t172.30.1.132\t24551\t172.30.1.254\t53\tudp\t65502\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:43.958Z","host":{"name":"f6b540842a86"},"log":{"offset":416681,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637227 Key: Timestamp: 2025-12-09 03:27:45.068 Headers: empty

{"@version":"1","event":{"hash":"cf1c25f8efc52cff40f0d793f282c0306651e53b861d424b351d8b3ea515d076"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250853.545125\tClFrU2daUssSioF4i\t172.30.1.12\t33563\t172.30.1.254\t53\tudp\tdns\t0.002812\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:44.356Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":501478},"tags":["beats_input_codec_plain_applied"]}

Offset: 637228 Key: Timestamp: 2025-12-09 03:27:46.074 Headers: empty

{"@version":"1","event":{"hash":"58a27f094e2f8e47b9f08e91b5f7c1db76824d099f7053a49c952d9f469c01e8"},"ecs":{"version":"1.6.0"},"message":"1765250863.504805\tCZQhQlmhnC0f9I26c\t172.30.1.132\t24551\t8.8.8.8\t53\tudp\t65502\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:44.964Z","host":{"name":"f6b540842a86"},"log":{"offset":417015,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637229 Key: Timestamp: 2025-12-09 03:27:46.074 Headers: empty

{"@version":"1","event":{"hash":"2287c2bc26a586889a6c7acb5a5d61d0576be4c154d0ec07351566187ddcab3a"},"ecs":{"version":"1.6.0"},"message":"1765250863.646111\tCXfTObaxfHosFdsy9\t172.30.1.12\t37489\t172.30.1.254\t53\tudp\t35618\t0.001985\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:44.964Z","host":{"name":"f6b540842a86"},"log":{"offset":416838,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637230 Key: Timestamp: 2025-12-09 03:27:46.074 Headers: empty

{"@version":"1","event":{"hash":"a79c29f5c7533bc99bd76fcdf67b309cb67074a4e8fb01f32b1e0c6c659b5f5e"},"ecs":{"version":"1.6.0"},"message":"1765250864.654985\tCiWak54h9DQeVqf28a\t172.30.1.12\t54806\t172.30.1.254\t53\tudp\t35619\t0.003242\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:44.964Z","host":{"name":"f6b540842a86"},"log":{"offset":417166,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637231 Key: Timestamp: 2025-12-09 03:27:46.074 Headers: empty

{"@version":"1","event":{"hash":"9202b55cb2830050077248bc0d715a608dd431feb7e0468ad29158550f59cfa4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250858.907024\tCs062l1QDfjozI4ZC4\t172.30.1.63\t49754\t172.30.2.171\t5044\ttcp\t-\t2.048087\t0\t0\tS0\tT\tT\t0\tS\t2\t120\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:45.357Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":501606},"tags":["beats_input_codec_plain_applied"]}

Offset: 637232 Key: Timestamp: 2025-12-09 03:27:46.074 Headers: empty

{"@version":"1","event":{"hash":"8e278c42f41a0d6bb86a491c3898ff477a05b0405273e69516884bbcc52629b2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250854.554943\tC8NW7P1nvd8knmLrM7\t172.30.1.12\t51019\t172.30.1.254\t53\tudp\tdns\t0.003290\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:45.357Z","host":{"name":"f6b540842a86"},"log":{"offset":501732,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637233 Key: Timestamp: 2025-12-09 03:27:47.461 Headers: empty

{"@version":"1","event":{"hash":"7b9bcf6d5fd85a0edf3726fe86476da7cb9442dd4b84bbc18d1fb244578dd04c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250855.564889\tCFvEiC1ODUrglcsQs\t172.30.1.12\t40829\t172.30.1.254\t53\tudp\tdns\t0.003402\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:46.357Z","host":{"name":"f6b540842a86"},"log":{"offset":501861,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637234 Key: Timestamp: 2025-12-09 03:27:47.461 Headers: empty

{"@version":"1","event":{"hash":"5fea2e207a187ae4daa5440ec069d6139d04d04c5f532da9635d8c06a7a9e0ba"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250845.458635\tCd0jFg4i3u4EiJ4vz\t172.30.1.65\t5353\t224.0.0.251\t5353\tudp\tdns\t2.005193\t1377\t0\tS0\tT\tF\t0\tD\t4\t1489\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:46.357Z","host":{"name":"f6b540842a86"},"log":{"offset":501989,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637235 Key: Timestamp: 2025-12-09 03:27:48.467 Headers: empty

{"@version":"1","event":{"hash":"443f2fe12647f08bce60f3be99043ac5a00b7f9672273e814889cdba44c3d1f0"},"ecs":{"version":"1.6.0"},"message":"1765250865.668251\tCDuzEJ1pm2kRyuMfAd\t172.30.1.12\t44588\t172.30.1.254\t53\tudp\t35620\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:47.965Z","host":{"name":"f6b540842a86"},"log":{"offset":417344,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637236 Key: Timestamp: 2025-12-09 03:27:48.467 Headers: empty

{"@version":"1","event":{"hash":"da3a472363404f5f15bf62f17b033f36f4b4bb9c190376ee37d2a925a2b61007"},"ecs":{"version":"1.6.0"},"message":"1765250866.758678\tCdZ55x1Jge8rar0Lc\t172.30.1.35\t51056\t172.30.1.254\t53\tudp\t63096\t0.001517\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3455.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:47.965Z","host":{"name":"f6b540842a86"},"log":{"offset":417693,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637237 Key: Timestamp: 2025-12-09 03:27:48.467 Headers: empty

{"@version":"1","event":{"hash":"490e23c09f0c080e27057597ba00e2436e947edcff219579cfb34ddc1909eb21"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250856.574935\tCDRuiK2TQz06XlbiMa\t172.30.1.12\t33526\t172.30.1.254\t53\tudp\tdns\t0.003363\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:47.358Z","host":{"name":"f6b540842a86"},"log":{"offset":502118,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637238 Key: Timestamp: 2025-12-09 03:27:48.468 Headers: empty

{"@version":"1","event":{"hash":"46b386b4e2cad805819a127b0d5bff37660ed9408109fcd655fac3b075c47f87"},"ecs":{"version":"1.6.0"},"message":"1765250866.675032\tC3C0Qj1YsAN0ZcSGui\t172.30.1.12\t54914\t172.30.1.254\t53\tudp\t35621\t0.003200\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:27:47.965Z","host":{"name":"f6b540842a86"},"log":{"offset":417515,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637239 Key: Timestamp: 2025-12-09 03:35:56.023 Headers: empty

{"@version":"1","event":{"hash":"89f4a390fab6ffa557e09bb74dc4623867a022ea86c7a84cd12df60f14e0f7fc"},"ecs":{"version":"1.6.0"},"message":"1765251353.233950\tC0Y7m84yzMr8w2tWX5\t172.30.1.35\t64225\t104.17.160.116\t443\tTLSv13\tTLS_AES_256_GCM_SHA384\tx25519\tdata.osdknw.com\tT\t-\t-\tT\t-\t-\t-\t-\t-\t-\t-\t8a889e7a3d15642aeb93d20a85a5a1ca\t907bf3ecef1c987c889946b737b43de8","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:54.919Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/ssl.log"},"offset":96110},"tags":["beats_input_codec_plain_applied"]}

Offset: 637240 Key: Timestamp: 2025-12-09 03:35:56.023 Headers: empty

{"@version":"1","event":{"hash":"9b9fffe65b5a1925ea61c6f88721c80f5d23ec8229c0633e38093a3b27c65db3"},"ecs":{"version":"1.6.0"},"message":"1765251352.758975\tCMHhDg2I45oS9dmKbd\t172.30.1.35\t64221\t104.18.191.157\t443\tTLSv13\tTLS_AES_256_GCM_SHA384\tx25519\tosdkupdatenw.com\tT\t-\t-\tT\t-\t-\t-\t-\t-\t-\t-\t8a889e7a3d15642aeb93d20a85a5a1ca\t907bf3ecef1c987c889946b737b43de8","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:54.919Z","host":{"name":"f6b540842a86"},"log":{"offset":96325,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637241 Key: Timestamp: 2025-12-09 03:35:56.023 Headers: empty

{"@version":"1","event":{"hash":"36ec648b6356b52ed25b9d49c58ee472399383850beece45fbb62a5c96e6a270"},"ecs":{"version":"1.6.0"},"message":"1765251352.946481\tCUM5232qAW37d8fFO\t172.30.1.35\t64222\t23.199.41.79\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp256r1\tfiledownload.lenovo.com\tF\t-\t-\tT\tFOzlBB2HPUxofikFV1,FimucO4yrN3fEnLHc\t(empty)\tCN=*.lenovo.com,O=Lenovo Technology Sdn. Bhd.,L=Petaling Jaya,ST=Selangor,C=MY\tCN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US\t-\t-\tok\t3b5074b1b5d032e5620f69f9f700ff0e\td227a8dd2bb7d7ee4f648c1af087578a","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:54.919Z","host":{"name":"f6b540842a86"},"log":{"offset":96541,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637242 Key: Timestamp: 2025-12-09 03:35:56.024 Headers: empty

{"@version":"1","event":{"hash":"15abd518717964e61365e3c55935331c2f03a98dbf3d5a371391dc7391b8b90f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765251292.851674\tCEPafJ3tPJblldg449\t172.30.1.35\t63984\t142.250.204.67\t443\tudp\t-\t0.120447\t5894\t6269\tSF\tT\tF\t0\tDd\t10\t6174\t12\t6605\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:55.131Z","host":{"name":"f6b540842a86"},"log":{"offset":630620,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637243 Key: Timestamp: 2025-12-09 03:35:56.024 Headers: empty

{"@version":"1","event":{"hash":"d25c357c34c6a1b745c620317738d1c78a38fe1cfbe654d194fbe81b0cc1659a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765251343.409612\tC1kVYtRUn4BkKTXC9\t172.30.1.12\t44956\t172.30.1.254\t53\tudp\tdns\t0.004244\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:55.131Z","host":{"name":"f6b540842a86"},"log":{"offset":630760,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637244 Key: Timestamp: 2025-12-09 03:35:56.024 Headers: empty

{"@version":"1","event":{"hash":"880bbfd5ac295d78b85718b3dd4aad9d1a111acc075b110d8d3fd890f2d22e40"},"ecs":{"version":"1.6.0"},"message":"1765251353.246537\tCvUpPs4e0mQ4JMupZe\t172.30.1.35\t60242\t172.30.1.254\t53\tudp\t52867\t-\tdata.osdknw.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t104.17.160.116,104.17.159.116\t15.000000,15.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:55.408Z","host":{"name":"f6b540842a86"},"log":{"offset":536963,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 637245 Key: Timestamp: 2025-12-09 03:35:56.024 Headers: empty

{"@version":"1","event":{"hash":"a1ae07673af43afd8c62de0329fdb02225caad49d59a5259b02fc0766ba22723"},"ecs":{"version":"1.6.0"},"message":"1765251354.519717\tCwgNIav3aWaIEQgy3\t172.30.1.12\t37909\t172.30.1.254\t53\tudp\t36104\t0.003540\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t15.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:55.408Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":537151},"tags":["beats_input_codec_plain_applied"]}

Offset: 637246 Key: Timestamp: 2025-12-09 03:35:57.023 Headers: empty

{"@version":"1","event":{"hash":"d3729e2d45824451d3aee5c5388273c70721f5054b1a19f5b86d38a32cd5c463"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765251344.419702\tCxWx1c2AieNDeCvXgj\t172.30.1.12\t56702\t172.30.1.254\t53\tudp\tdns\t0.003304\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:35:56.132Z","host":{"name":"f6b540842a86"},"log":{"offset":630888,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network