Kafdrop

{"@version":"1","event":{"hash":"49fbc6aae379ffbb0058603a40bf29007eac89f696e928cba8dcbb15a1791dc1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250263.179308\tC28spc3kDnIJxE8HCa\t172.30.1.12\t42507\t172.30.1.254\t53\tudp\tdns\t0.003265\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:54.722Z","host":{"name":"f6b540842a86"},"log":{"offset":325043,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0ad7bef881c0d6cabec233e1f87c438ec1eb6319639193b1d24c8677725ed9f7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250263.836656\tCmOGl82BLzUt42NVqe\t172.30.1.132\t18448\t8.8.8.8\t53\tudp\tdns\t0.027988\t43\t43\tSF\tT\tF\t0\tDd\t1\t71\t1\t71\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:54.722Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":325172},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f362b809e6cb09ade99a29d2895075df0c6b32da877dad8d70e6d4c8b49789b3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250264.189313\tCMu8pz23O7hRjwnxt3\t172.30.1.12\t48987\t172.30.1.254\t53\tudp\tdns\t0.003245\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:55.723Z","host":{"name":"f6b540842a86"},"log":{"offset":325297,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b27dfe81e2f8d2c2f65009838a262f44220719a6385c28087c22b964d982e758"},"ecs":{"version":"1.6.0"},"message":"1765250275.299393\tCCAAr918CK08UwjDD7\t172.30.1.12\t44615\t172.30.1.254\t53\tudp\t35039\t0.003434\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:56.496Z","host":{"name":"f6b540842a86"},"log":{"offset":272201,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5b8cfb633414716fda882f21f91bf9d4f5daf7924be51f64d41f445ff70d4f5d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250265.199328\tCnquQDcbDCJ7b9cM\t172.30.1.12\t51823\t172.30.1.254\t53\tudp\tdns\t0.005809\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:55.723Z","host":{"name":"f6b540842a86"},"log":{"offset":325426,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"100aaf8f7ef89582357cde950fe8a07fbd3de3a3b774446fd87c0f63060fdca5"},"ecs":{"version":"1.6.0"},"message":"1765250267.241834\tCJFO6u3DtBwSN56TTh\t114.119.146.107\t62663\t172.30.1.2\t80\t1\tGET\twww.siamsecure.net\t/sites/all/modules/views/modules/locale\thttp://www.siamsecure.net/sites/all/modules/views/modules\t1.1\tMozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)\t-\t0\t249\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFZ7YJX1CI8LmI8dTub\t-\ttext/html","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:56.704Z","host":{"name":"f6b540842a86"},"log":{"offset":7794,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d161389d8ef9ec9b178a33d704295e1f1ceab185704649e0a43cceec1945da58"},"ecs":{"version":"1.6.0"},"message":"1765250267.405870\tCpVoIv2H2dawmQwS14\t114.119.146.107\t55057\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp256r1\twww.siamsecure.net\tF\t-\t-\tT\tFDH8sB2q6W1jHIp6e6,FeRTbu7Z2mQj1s5x5\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc199b43d41b470f8f68c5561f8f1ce3e\t758945630046fd37070521b8544d1fe8","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:55.724Z","host":{"name":"f6b540842a86"},"log":{"offset":48025,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"327a64ca5c0db5485a59ab0c7670faa60438fb13f87802acf6365f665d3515e3"},"ecs":{"version":"1.6.0"},"message":"1765250274.289397\tC4YuTb3NPYZXnKxXS5\t172.30.1.12\t51258\t172.30.1.254\t53\tudp\t35038\t0.003463\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:56.496Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":272023},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"585c4e632c7d805efc07ae61f3a3898b70793d7773d18c5841327df39272e07d"},"ecs":{"version":"1.6.0"},"message":"1765250276.309424\tCW3lB52LzJeoVMh0cf\t172.30.1.12\t48193\t172.30.1.254\t53\tudp\t35040\t0.003483\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:57.497Z","host":{"name":"f6b540842a86"},"log":{"offset":272545,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f8c26e6aaf3981fa76ceb2df3696db7085cf51d7917ee3f1bb7b0c08c44c00af"},"ecs":{"version":"1.6.0"},"message":"1765250276.630192\tCMsWBz2qxbR9XQcmGg\t202.46.62.80\t46198\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=chll&smid=1909&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t265\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFFAZFo2TD0s1nRWSh8\t-\ttext/html","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:57.705Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/http.log"},"offset":8233},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"11c7c42288aa9a6ccd7b03f482467fb6df80dd94d72b14c94a94b1319631bb79"},"ecs":{"version":"1.6.0"},"message":"1765250276.808635\tCV6QwB1U1cNRN1WZE6\t172.30.1.35\t51620\t172.30.1.254\t53\tudp\t35549\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t475.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:57.497Z","host":{"name":"f6b540842a86"},"log":{"offset":272379,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"24fe205d66e482abd6bb6b15f7ff08a3e9aebc4dfe3101fe493b7769fb4f1be0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250271.504863\tCTFypU2h6CnxsbKza9\t172.30.1.4\t52270\t154.41.93.198\t6101\ttcp\t-\t0.086219\t198\t64\tSF\tT\tF\t0\tShADadFf\t6\t518\t4\t280\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"offset":325553,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"75232b1073efbfafbaf6a998a0ba696f27652aa559da2e979a993d7e80135c8b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250266.209487\tC1g5FDpkiaujHZPZ8\t172.30.1.12\t35392\t172.30.1.254\t53\tudp\tdns\t0.003432\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":325691},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8468e5f5af098f5581c3690275c79e7263253ac85024ec6f1c74e3d66d0b735a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250266.747274\tCSkNss27F6QPDVhjra\t172.30.1.35\t60104\t172.30.1.254\t53\tudp\tdns\t0.005681\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"offset":325819,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4fafc32ae06383f0db79c8fcef71a96abb049dfbb74d553072b5ef0e5f46809b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250217.659148\tC8rbvH3EhtrhM5BZ25\tfe80::b2be:76ff:fec9:7610\t130\tff02::1\t131\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"offset":326079,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"711d39b34b10df760c679105d4bd889579cc951a194e425bac08a12e296351c1"},"ecs":{"version":"1.6.0"},"message":"1765250277.319435\tC8j691nfKKAVGIj9j\t172.30.1.12\t53076\t172.30.1.254\t53\tudp\t35041\t0.003734\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.498Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":272723},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5b598b18400438338329003af9da97e1488ab9bc347c50c71b1e2104279e24d9"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250267.219341\tCaR8984QhyKjwdrj95\t172.30.1.12\t34431\t172.30.1.254\t53\tudp\tdns\t0.002747\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"offset":325950,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b1f0d0fb0b702d89505f4c208165a52478db0e6c47b31a4181da92567f58abda"},"ecs":{"version":"1.6.0"},"message":"1765250276.842666\tClI3fs2bQIb2g1LGIa\t202.46.62.118\t16042\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tFZ4eDcg4XqS32yn3,FBWtZic5zVemqczE\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:58.725Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/ssl.log"},"offset":48383},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"73df0eae26d8e524e572b7f65c9fd8e8e1f90aabe1288cf891226a23171beddc"},"ecs":{"version":"1.6.0"},"message":"1765250278.329443\tCfYTrN34iZYftRHTOl\t172.30.1.12\t49316\t172.30.1.254\t53\tudp\t35042\t0.015243\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:59.498Z","host":{"name":"f6b540842a86"},"log":{"offset":272900,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"36512eefe2cc927a6cbf67235b2222218015940e9d70eb8102636e105c019aca"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250218.349763\tCzXRGs1opuh1YKY3wk\tfe80::c251:7eff:fefb:e9d7\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t96\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:59.725Z","host":{"name":"f6b540842a86"},"log":{"offset":326334,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c263d5ccbc45663740d6a2056fd0c14b871507365701e2200c96e3b02cbb8637"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250268.229863\tCITj6j3uZxPNNHNEFi\t172.30.1.12\t58769\t172.30.1.254\t53\tudp\tdns\t0.002238\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:59.725Z","host":{"name":"f6b540842a86"},"log":{"offset":326205,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"96551868b4e9c8f8a97bb765fe1877b968e870cfc32527c1dde5b83a75e36ccc"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250218.600405\tCVNkel4xedROGUXWsa\tfe80::2c41:11ff:fe33:ac74\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:17:59.726Z","host":{"name":"f6b540842a86"},"log":{"offset":326459,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"83a191da599951a5e9c849af3e48897f42c1dc6dff372f35c5bf5f5a90951be6"},"ecs":{"version":"1.6.0"},"message":"1765250279.579722\tCQkCB11X5nphaKOtnj\t172.30.1.35\t59237\t8.8.8.8\t53\tudp\t17819\t0.027968\toutlook.office.com\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tT\t0\tsubstrate.office.com,outlook.office365.com,ooc-g2.tm-4.office.com\t33.000000,65.000000,269.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:00.499Z","host":{"name":"f6b540842a86"},"log":{"offset":273078,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7e8906a7bcc99e3bf9d218f4fdad63c54044144780ddf49d8c2b11ba88a41319"},"ecs":{"version":"1.6.0"},"message":"1765250279.339534\tCJONRj1luv9eOkYGoi\t172.30.1.12\t47008\t172.30.1.254\t53\tudp\t35043\t0.003521\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:00.499Z","host":{"name":"f6b540842a86"},"log":{"offset":273326,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"804aaa4e2bd5b8d130af2eb25c809a22c12ca0aec068dbf7c29684375b61e09d"},"ecs":{"version":"1.6.0"},"message":"1765250279.494198\tCbAKS321Neflyn9Hhi\t172.30.1.35\t57000\t8.8.8.8\t53\tudp\t44978\t0.027149\tdns.google\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t8.8.8.8,8.8.4.4\t872.000000,872.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:00.499Z","host":{"name":"f6b540842a86"},"log":{"offset":273504,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d9ab3e387e67bc3015a93433bc7b94dff6f782ff2b5466480ebe3207b25de8a2"},"ecs":{"version":"1.6.0"},"message":"1765250279.640172\tCNLmtv2VOvkxy3GSf1\t172.30.1.35\t63199\t8.8.8.8\t53\tudp\t50015\t-\toutlook.office.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tsubstrate.office.com,outlook.office365.com,ooc-g2.tm-4.office.com,outlook.ms-acdc.office.com,xsp-efz.ms-acdc.office.com,52.98.50.18,52.98.77.114,40.100.29.242,52.98.50.66\t6.000000,206.000000,127.000000,22.000000,24.000000,4.000000,4.000000,4.000000,4.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:00.499Z","host":{"name":"f6b540842a86"},"log":{"offset":273677,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6e1671b861d8a0d2ffd174ed05123755876d962a992704b7e109d677d5f4be94"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250269.239335\tCLzWy8287AEQcu9Z1\t172.30.1.12\t34164\t172.30.1.254\t53\tudp\tdns\t0.002790\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:00.726Z","host":{"name":"f6b540842a86"},"log":{"offset":326584,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"09aaae0df579dc390a9130d3996c1efdfff56a981708949c049047adb703087d"},"ecs":{"version":"1.6.0"},"message":"1765250279.494069\tCshLOW22pGzgMxfnH1\t172.30.1.35\t53868\t8.8.8.8\t53\tudp\t5072\t-\tdns.google\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:01.499Z","host":{"name":"f6b540842a86"},"log":{"offset":274071,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2afc756804f0a3b0e9ae3fcea18ab8fd44e85a3c24bf75cfc32503f5d82bdcbd"},"ecs":{"version":"1.6.0"},"message":"1765250280.349439\tCVkrULbh4VLALSJLf\t172.30.1.12\t36979\t172.30.1.254\t53\tudp\t35044\t0.002661\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:01.499Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":274210},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"43c145af14a8260fe899ed887c342e1dfc582d8814061220160cfeda03c8d45e"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250220.390424\tCQfx202sq5vtPS3Coi\tfe80::22e4:300:8a61:450b\t143\tff02::16\t0\ticmp\t-\t0.000390\t40\t0\tOTH\tF\tF\t0\t-\t2\t152\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:01.726Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":326712},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f7e27e5de07905f9fb2c13bbe2baedcb5820cbb9ddefb2fff29183ef6bc03120"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250270.250685\tCiBJFI2rFBtfWgJDQ\t172.30.1.12\t53454\t172.30.1.254\t53\tudp\tdns\t0.001597\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:01.726Z","host":{"name":"f6b540842a86"},"log":{"offset":326845,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5fd01ba2d8292df6590a4d624a41f73403d714d389c8d35065433f1ffa67d5fd"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250221.004537\tCrHGIw4RByeHjLoi9d\tfe80::6263:4cff:febc:17c6\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:01.726Z","host":{"name":"f6b540842a86"},"log":{"offset":326973,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"775ce38d881799fa1e76587f21f85583cd5f9bf1aeb1d45c780ea7de93ed4b48"},"ecs":{"version":"1.6.0"},"message":"1765250281.790588\tC58nZY3FHj9rPEZz02\t172.30.1.35\t63819\t8.8.8.8\t53\tudp\t58153\t0.029221\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1420.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.500Z","host":{"name":"f6b540842a86"},"log":{"offset":274387,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cf021d3571186368d206dd60de27485248b5e9c059eb955eddcc2b8fc946fdf2"},"ecs":{"version":"1.6.0"},"message":"1765250281.359445\tCp76KB3vzDkT7g5zQ7\t172.30.1.12\t46342\t172.30.1.254\t53\tudp\t35045\t0.003070\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.500Z","host":{"name":"f6b540842a86"},"log":{"offset":274556,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f1c242d8cfd61c338dc44673e025004a8b5830f222f1c2f5b1935da0cac8daa6"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250221.995703\tCriDMM2Y7FIuPYBeR1\tfe80::ca1f:66ff:fecb:6f36\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.727Z","host":{"name":"f6b540842a86"},"log":{"offset":327483,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b80e8575ca7363bf0d18be43c55da47dcb59c07d1010e9b270377df7afd2406e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250271.259385\tCZuFXIpjd2TRN0WG5\t172.30.1.12\t41413\t172.30.1.254\t53\tudp\tdns\t0.003541\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.727Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":327224},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9e291ef3ee5b99a9f6386cd90b56fbe7bd4538bfa98677ee87e149eab108a3ce"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250271.753370\tCHeBGv4hLwKD48xeEi\t172.30.1.35\t56275\t172.30.1.254\t53\tudp\tdns\t0.025401\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.727Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":327352},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e5e9f9dded07cbb0cc714c48506f18dfb8c6cc458bc1cef8255affc4262ee9c3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250275.527244\tCMsWBz2qxbR9XQcmGg\t202.46.62.80\t46198\t172.30.1.2\t80\ttcp\thttp\t1.180854\t311\t510\tSF\tF\tT\t0\t^hSADadfF\t7\t691\t7\t898\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.727Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":327609},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"51908507a980f6a95af4be86600c2caecde3393a895dc6da2921c961c115917e"},"ecs":{"version":"1.6.0"},"message":"1765250282.369442\tCGHxoj4eglNmlc40ik\t172.30.1.12\t38568\t172.30.1.254\t53\tudp\t35046\t0.003162\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:03.500Z","host":{"name":"f6b540842a86"},"log":{"offset":274907,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"64b74b59292d9e408cc01a3f1ad1c9b51c69efa862c9d62a5a23e33f50c3be79"},"ecs":{"version":"1.6.0"},"message":"1765250281.751649\tCwBlLa43MjVp5nJJC1\t172.30.1.35\t63819\t172.30.1.254\t53\tudp\t58153\t0.082395\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t470.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:03.500Z","host":{"name":"f6b540842a86"},"log":{"offset":274734,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"35edf1c140ff34cee8c465d2c7d676be541d3c67414439f432b0621ccc27a655"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250220.611171\tCzcUl74mAjp1z5Xod7\tfe80::5ec5:63ff:fe93:7e19\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:02.727Z","host":{"name":"f6b540842a86"},"log":{"offset":327099,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"be06a51f808ee38c6f03d135b8da814ee759ecab94e2da5a33e67efc59c03f06"},"ecs":{"version":"1.6.0"},"message":"1765250276.888988\tFZ4eDcg4XqS32yn3\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:03.704Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/x509.log"},"offset":29778},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0cb5b7bb282a1867851d87664a13f5cc9b22c402a8428a6186d1e2a923f56491"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250272.269395\tCYoncD1D8HSqleJRXa\t172.30.1.12\t33096\t172.30.1.254\t53\tudp\tdns\t0.003165\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:03.728Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":327749},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"60c417ae93a82b0d9daa48d7c3404fb583b74f54880f2248cdb38eac10ddcc45"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250222.511793\tC1U3WXb7H5SPx3GO1\tfe80::c55e:ff17:5ec1:f6be\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:04.728Z","host":{"name":"f6b540842a86"},"log":{"offset":327878,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"02167d9a9ac9612b5d513c64794daa0dc0665f766ecb05c6656301fb2ae3e57b"},"ecs":{"version":"1.6.0"},"message":"1765250283.379491\tCHYV9G2GvhYLJHYIZk\t172.30.1.12\t42112\t172.30.1.254\t53\tudp\t35047\t0.003594\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:04.501Z","host":{"name":"f6b540842a86"},"log":{"offset":275085,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d8b01d0c221a325e646b193caccf02431398180e966eb2f944d91fe51163587d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250273.279571\tCcQ30X3mVwDntWnvl\t172.30.1.12\t58333\t172.30.1.254\t53\tudp\tdns\t0.003039\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:04.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328002,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9d2f05281d31bd29d2b34ffeae6a950c1c9ff30af72b44bc0bbe1fe79524e0fd"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250223.581182\tCkuDue3jRSUNx7Gb05\tfe80::c251:7eff:fe56:e095\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:04.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328130,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fa2515be1fc89283ce00d4535b22f1f22102046cf6c045833cfc957848d3b410"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250279.504798\tCl733I200ttEs0Wjhl\t10.10.10.1\t49614\t10.10.10.203\t8000\ttcp\t-\t0.130158\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:05.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328255,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6f64b32bdac6f035b98d6d243a5906ca483755d7111dc3878ee32c3d6501fe71"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250274.289397\tC4YuTb3NPYZXnKxXS5\t172.30.1.12\t51258\t172.30.1.254\t53\tudp\tdns\t0.003463\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:05.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328384,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7f01e5684b67aafee5499590f42e40f53f3a11604d7a5849dbc36e0a2893d179"},"ecs":{"version":"1.6.0"},"message":"1765250284.389576\tCyJ5UgUBVLvi3NfKe\t172.30.1.12\t34309\t172.30.1.254\t53\tudp\t35048\t0.002976\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:05.502Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":275263},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"62661c1e32867b64ef5ca51a49d946334d2dd5f01443e5ed199dc578b25966f4"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250225.038679\tC6oM4B10Jt3HfBPdsa\tfe80::a272:2cff:fef5:f5fb\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t116\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:05.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328638,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"da1a711ffb14a0fcd0ae297593c9c4a83aa1bca1338f74e43aff877e03707e61"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250279.700011\tCACyK2422a2UaOQnKc\t172.30.1.2\t33198\t172.30.4.139\t1514\ttcp\t-\t3.000532\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:05.728Z","host":{"name":"f6b540842a86"},"log":{"offset":328513,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a7ad4f022d40b7d1ab64eae0c1de1c84d9bba3e8b492c8765a67de67123a6805"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250162.508279\tCDFBJu4Sn4JjgeVy04\tfe80::68b5:14e3:6da1:5bd8\t546\tff02::1:2\t547\tudp\t-\t63.042484\t602\t0\tS0\tF\tF\t0\tD\t7\t938\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:06.729Z","host":{"name":"f6b540842a86"},"log":{"offset":328893,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bf5e2a1d2fb7481977be1970e640342ba0e9262e70bab7c146174f38978378db"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250276.757682\tClI3fs2bQIb2g1LGIa\t202.46.62.118\t16042\t172.30.1.2\t443\ttcp\tssl\t4.022792\t1082\t19037\tRSTR\tF\tT\t0\tShADadtTtfRr\t23\t2887\t36\t40384\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:06.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329030,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"56ec6bf46b0f29bcc9c771fa41bd0cb41b2e66d18678ecad48ae46f04cf910c6"},"ecs":{"version":"1.6.0"},"message":"1765250285.399519\tChC9CO2GA0YuB9hlvj\t172.30.1.12\t39800\t172.30.1.254\t53\tudp\t35049\t0.003452\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:06.502Z","host":{"name":"f6b540842a86"},"log":{"offset":275440,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2ba803d26a63204427c430eabf084179fe9d3de6acb1b5e5a30b309c5599d417"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250275.299393\tCCAAr918CK08UwjDD7\t172.30.1.12\t44615\t172.30.1.254\t53\tudp\tdns\t0.003434\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:06.729Z","host":{"name":"f6b540842a86"},"log":{"offset":328764,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"60352aacff4c1332267d4725a30c79f67331df24f9beff459a62d79eaaa44328"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250276.309424\tCW3lB52LzJeoVMh0cf\t172.30.1.12\t48193\t172.30.1.254\t53\tudp\tdns\t0.003483\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329449,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"147dfd601ec846cdc782bbfd03a237d7db13762edf59413d4dfdaf52ddb7bc47"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250217.993278\tCq6RPZ2LWpdivkBY3l\tfe80::68b5:14e3:6da1:5bd8\t143\tff02::16\t0\ticmp\t-\t8.990973\t80\t0\tOTH\tF\tF\t0\t-\t4\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329703,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"43c0f395e974cda13a8a6f61e1cd22cc503b11022fa058ba5795dfe1c615b790"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250226.404701\tCTAQng3D947lsUTxxc\tfe80::222:19ff:fe59:6c3c\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":329578},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"be49378c8c3a1f7db9a85cb6b612f0b282bf2fcfaafb93d7c11a7d2ba3056159"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250218.253812\tCnrYpj49OvAiB8B7ub\tfe80::a629:9f54:45ee:d1d5\t143\tff02::16\t0\ticmp\t-\t7.992926\t80\t0\tOTH\tF\tF\t0\t-\t4\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329184,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"19f9f057d366c8beb446290df9e51c78ef03d8283a99d2fff480b34792c01279"},"ecs":{"version":"1.6.0"},"message":"1765250287.419518\tCtrLpE3G2Lr5OEmaNe\t172.30.1.12\t55406\t172.30.1.254\t53\tudp\t35051\t0.003368\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:08.503Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":275969},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f8b4fe4118f77f8b824a98b413bae64febe29c04215989c017c44e497db6e3f9"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250276.745748\tCV6QwB1U1cNRN1WZE6\t172.30.1.35\t51620\t172.30.1.254\t53\tudp\tdns\t0.004977\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329318,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5bd6a0b2a70bc1f504b5e84d157030c84682bd08d094af2e25fddb740524eba2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250226.998836\tCKpM4n1mvHzKTHeAv2\tfe80::2a87:baff:fee8:8f52\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329837,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"330c0c5e9d315c64159e739eba4e47f0be8ba74c9576cb7ae695a4ec22c14ba5"},"ecs":{"version":"1.6.0"},"message":"1765250286.409506\tCm5xbg1HtYILDs98qa\t172.30.1.12\t59411\t172.30.1.254\t53\tudp\t35050\t0.003385\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:07.502Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":275618},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b1f30d03e7e6e5db29c195673f2d59d2237d182f57c324abaac66f3ba6a09fcc"},"ecs":{"version":"1.6.0"},"message":"1765250286.755598\tCuD59f1OVx2HDTSwn9\t172.30.1.35\t52881\t172.30.1.254\t53\tudp\t54439\t0.005366\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t465.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:08.503Z","host":{"name":"f6b540842a86"},"log":{"offset":275796,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"eb446cc0420182e306133e3535f37744c124ee35f013c3916c574a20d99a1411"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250226.894224\tC2UUR72iHL2ogyFTc8\tfe80::86c9:b2ff:fe5c:232\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t96\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:08.729Z","host":{"name":"f6b540842a86"},"log":{"offset":329963,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c89ead5002528fdef0aaf1ebd532022e3d3c2212ec3e6d3ba1b213202a64a4b6"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250277.319435\tC8j691nfKKAVGIj9j\t172.30.1.12\t53076\t172.30.1.254\t53\tudp\tdns\t0.003734\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:08.729Z","host":{"name":"f6b540842a86"},"log":{"offset":330220,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2c3f7bf2ec9476c3d191b64f4ec248e2ed7347bb02e994b5fbdbb514a62ad824"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250221.105275\tCVPylx1opVsFnuCrPf\tfe80::c86:954f:5d3e:13c9\t143\tff02::16\t0\ticmp\t-\t5.999989\t80\t0\tOTH\tF\tF\t0\t-\t3\t248\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:08.729Z","host":{"name":"f6b540842a86"},"log":{"offset":330087,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b8910486a5af01cbd2eedfb3de91deef3ba93f684f6d55453de7d91c321c54df"},"ecs":{"version":"1.6.0"},"message":"1765250288.429573\tC2bait1z6dDnVZCujl\t172.30.1.12\t39424\t172.30.1.254\t53\tudp\t35052\t0.003495\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:09.503Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":276147},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c7ca0f713801251318e917f50925e3715f378792290df3360b57462ee2a86e7a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250278.329443\tCfYTrN34iZYftRHTOl\t172.30.1.12\t49316\t172.30.1.254\t53\tudp\tdns\t0.015243\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:09.735Z","host":{"name":"f6b540842a86"},"log":{"offset":330348,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8aeb446fba8c3d86834f5174ab4e3f1b2e84fb411d23749cef8543bbb3f46e37"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250279.494069\tCshLOW22pGzgMxfnH1\t172.30.1.35\t53868\t8.8.8.8\t53\tudp\tdns\t0.026201\t28\t104\tSF\tT\tF\t0\tDd\t1\t56\t1\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.735Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":330477},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"01dc3dc90c9c6c082f36222b74789d9b2ec1d7f403f8da83a94bf25854a199ff"},"ecs":{"version":"1.6.0"},"message":"1765250289.482715\tCJDzX64ppgDK3jqLS3\t172.30.1.12\t54426\t172.30.1.254\t53\tudp\t35053\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.504Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":276325},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f874b7dc56f337f1e209a90f264e1db8da7a415bbf7b19ef40f58fe09a319352"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250279.579722\tCQkCB11X5nphaKOtnj\t172.30.1.35\t59237\t8.8.8.8\t53\tudp\tdns\t0.027968\t36\t201\tSF\tT\tF\t0\tDd\t1\t64\t1\t229\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.735Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":330603},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bdc7b34382d5594fca2eb2116c5e9140b956cf6d86bda7d3e115cc5d4464512f"},"ecs":{"version":"1.6.0"},"message":"1765250288.730399\tFH61qS1GQjbKKpIoN2\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.705Z","host":{"name":"f6b540842a86"},"log":{"offset":30067,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"701b1ef19d7a01a8a93a6827a89bd97216495a15510d6aa4623459ebac043b4f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250279.339534\tCJONRj1luv9eOkYGoi\t172.30.1.12\t47008\t172.30.1.254\t53\tudp\tdns\t0.003521\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.735Z","host":{"name":"f6b540842a86"},"log":{"offset":330729,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f4d30836159faff493d771cd8114c309e92d90fb69df4242ff105de843b57537"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250279.494198\tCbAKS321Neflyn9Hhi\t172.30.1.35\t57000\t8.8.8.8\t53\tudp\tdns\t0.027149\t28\t60\tSF\tT\tF\t0\tDd\t1\t56\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.735Z","host":{"name":"f6b540842a86"},"log":{"offset":330858,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9e18a6558c8204f83b1ec5e01670bc2a89b91deb3682d4e3a5ed9e398a9b6c53"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250279.580160\tCNLmtv2VOvkxy3GSf1\t172.30.1.35\t63199\t8.8.8.8\t53\tudp\tdns\t0.026986\t36\t234\tSF\tT\tF\t0\tDd\t1\t64\t1\t262\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:10.735Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":330982},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"89adf5347d463a50adceba1f772cd03ee2502d142c0bff31ef930c5d69dc4fdc"},"ecs":{"version":"1.6.0"},"message":"1765250291.459962\tCDL4Rz3cmw1kcDPVbb\t172.30.1.12\t46735\t172.30.1.254\t53\tudp\t35055\t0.002608\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.524Z","host":{"name":"f6b540842a86"},"log":{"offset":276843,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7769fe6de6e1475b0a200ff984485ca22032ba32bd776d33294a51503423d868"},"ecs":{"version":"1.6.0"},"message":"1765250290.449601\tC2GMeP26axn1rGcp27\t172.30.1.12\t43586\t172.30.1.254\t53\tudp\t35054\t0.003473\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:11.504Z","host":{"name":"f6b540842a86"},"log":{"offset":276496,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2c04621451d696f1fee0fe5a15a997aaeaa12698a4f28fcc01daf77a8316a5df"},"ecs":{"version":"1.6.0"},"message":"1765250290.721260\tFBtoMn2QjoLbY8oUbe\t3\t2A4D3ADCCA340F95D09491E7\tCN=*.sgmbocast.com\tCN=GlobalSign GCC R6 AlphaSSL CA 2023,O=GlobalSign nv-sa,C=BE\t1748934718.000000\t1783235517.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\t*.sgmbocast.com,sgmbocast.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:11.705Z","host":{"name":"f6b540842a86"},"log":{"offset":30358,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4c2d46b14e9a46e8fe0ee76e8199477d8a56eac735f16de4a8c3582318632e18"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250280.349439\tCVkrULbh4VLALSJLf\t172.30.1.12\t36979\t172.30.1.254\t53\tudp\tdns\t0.002661\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:11.736Z","host":{"name":"f6b540842a86"},"log":{"offset":331108,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"43a54c1034ccd56f15c08aa543b376591ddba4ea732fd1eb72799425c075457c"},"ecs":{"version":"1.6.0"},"message":"1765250291.783716\tCEPFI82Ho3bGMO1XZ6\t172.30.1.35\t64240\t8.8.8.8\t53\tudp\t52295\t0.028120\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1410.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.523Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":276674},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8b718023f5e80c1dae69de34a2bd781460665f3002a5538854eb1db88f060e1c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249610.898215\tCcZt9h2f9uW4StA8Sc\t172.30.1.57\t46760\t216.239.32.223\t443\ttcp\tssl\t675.318995\t1599\t5724\tSF\tT\tF\t0\tShADadtfFr\t14\t2347\t13\t6423\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.737Z","host":{"name":"f6b540842a86"},"log":{"offset":331236,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e178fe22755f5091ad94c1775b9342025475230ff91d95ad608b042f746d53cd"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250281.359445\tCp76KB3vzDkT7g5zQ7\t172.30.1.12\t46342\t172.30.1.254\t53\tudp\tdns\t0.003070\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.737Z","host":{"name":"f6b540842a86"},"log":{"offset":331785,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a44b9290377de062c524c7be4782c78ca9aea091bb75d9a770fb9368fb93379f"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765250286.877013\tC0aaa049VrOJG2IDcg\t172.30.1.2\t40872\t172.30.4.136\t5044\ttcp\t-\t2.991806\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.737Z","host":{"name":"f6b540842a86"},"log":{"offset":331388,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"748a2a2f9cd37a688ccf6357987ca7954207cb0b04cbd06253af1b7c7f1fea5a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250281.790588\tC58nZY3FHj9rPEZz02\t172.30.1.35\t63819\t8.8.8.8\t53\tudp\tdns\t0.029221\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.737Z","host":{"name":"f6b540842a86"},"log":{"offset":331659,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a6caa27d3cc07ea4100f739a5ef306f4f165dbf44f7feeec4e054fcc26fcbd48"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250286.291275\tCPnsqcCo2WggpFIYb\t172.30.1.57\t44714\t3.166.34.78\t443\ttcp\tssl\t0.034009\t723\t5061\tRSTO\tT\tF\t0\tShADadRfR\t12\t1319\t10\t5589\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.737Z","host":{"name":"f6b540842a86"},"log":{"offset":331513,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fb6a8b5e0475d6de058b45fd82f89d1d4cbc5fcb9381d49a382facf28184bde6"},"ecs":{"version":"1.6.0"},"message":"1765250291.894006\tC1Rnfw1h8n3G2Pghm9\t172.30.1.57\t41242\t202.168.105.11\t80\t1\tPOST\tbstream.sgmbocast.com\t/y.gif?encrypt=1\t-\t1.1\tBigoLive-Android 2911957711\t-\t0\t14\t200\tOK\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFuz45C2W4oxh4vwOsh\t-\ttext/json","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:12.706Z","host":{"name":"f6b540842a86"},"log":{"offset":8572,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"89244c4c0d4527dc8ac47c570b4bde60a612e213df762d0c3593e77e5c54f341"},"ecs":{"version":"1.6.0"},"message":"1765250292.469536\tCNr4LV18g4tblLHJF5\t172.30.1.12\t51572\t172.30.1.254\t53\tudp\t35056\t0.005826\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:18:13.524Z","host":{"name":"f6b540842a86"},"log":{"offset":277194,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b0b77ff55bcd01c6b31c327fd326cfff1271e2f08661503e7a3d08608c44b3d5"},"ecs":{"version":"1.6.0"},"message":"1765251127.497657\tCYnj1w1zCJ79BH5Kpk\t202.46.62.13\t28180\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=rkdg&smid=13401&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t266\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tF3KxOh1ZjwVQrToDcf\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:13.781Z","host":{"name":"f6b540842a86"},"log":{"offset":14645,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"824362c134ce3ff55a0b897741c5dccbf03bd8a784a050faa2917884058ea0f9"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765251121.207557\tCsIBJv2ESir5lshabf\t172.30.1.12\t43658\t172.30.1.254\t53\tudp\tdns\t0.004364\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:13.844Z","host":{"name":"f6b540842a86"},"log":{"offset":571907,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d2aaf2ebf24f34728ef45535d09aeb54bb8d47e2872ab96a7dfe791913efb3b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765251122.217494\tCAcPD2454vhJ3fkG18\t172.30.1.12\t45252\t172.30.1.254\t53\tudp\tdns\t0.003123\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:13.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":572162},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"eb0144ef6e32dffdd51af59780da719d94efd4926b14f8e0efa971538ea37ecc"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765251121.802429\tChirXw3I0LSP1lChJ2\t172.30.1.35\t59899\t8.8.8.8\t53\tudp\tdns\t0.028217\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:13.844Z","host":{"name":"f6b540842a86"},"log":{"offset":572036,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"52874469f5d3cfaa51a28d8e77d5a503b37302da5dcc3bd131452b9e5825ef01"},"ecs":{"version":"1.6.0"},"message":"1765251131.307608\tCcpxH51QRUMQflOBog\t172.30.1.12\t60208\t172.30.1.254\t53\tudp\t35883\t0.003509\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:14.221Z","host":{"name":"f6b540842a86"},"log":{"offset":481806,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"88754d09e1e62a39b82e3571c7722a346f44b201c829fbb75db601a44771c12b"},"ecs":{"version":"1.6.0"},"message":"1765251131.753030\tCLzyS429aJ42NSdJGi\t172.30.1.35\t51742\t172.30.1.254\t53\tudp\t21130\t0.009001\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1780.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:14.221Z","host":{"name":"f6b540842a86"},"log":{"offset":481984,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4d004948a613eb4e4c4f892764de9ad604481649b2b1df47df6dda65aed93efc"},"ecs":{"version":"1.6.0"},"message":"1765251132.317662\tCcDm661Zv6wVkSuNH3\t172.30.1.12\t55858\t172.30.1.254\t53\tudp\t35884\t0.002986\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:14.221Z","host":{"name":"f6b540842a86"},"log":{"offset":482158,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d51d92f82bba52233bbfc91bf1cf6ab4664d7d5d0a1697ddfa75a1888a46a36b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765251127.404274\tCYnj1w1zCJ79BH5Kpk\t202.46.62.13\t28180\t172.30.1.2\t80\ttcp\thttp\t0.168947\t312\t512\tSF\tF\tT\t1\tShADadfGF\t6\t632\t5\t780\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:14.844Z","host":{"name":"f6b540842a86"},"log":{"offset":572291,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6fc8cc3384ee152ca5e0f6e72b039bfe7b9b6907e3a2534d47dbfcf52d3d0b8d"},"ecs":{"version":"1.6.0"},"message":"1765251133.327545\tCdCULC3A89fGVePEBg\t172.30.1.12\t46987\t172.30.1.254\t53\tudp\t35885\t0.003135\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:15.221Z","host":{"name":"f6b540842a86"},"log":{"offset":482336,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b8783303ca7be6054a66d4e8f7c11a66f2a750f9aab51aea01ec8e6686b40c7c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765251129.148425\tCIlvjd116qcGo5Jczi\t10.10.10.1\t49804\t10.10.10.203\t8000\ttcp\t-\t0.000246\t0\t0\tSH\tT\tT\t0\tAF\t2\t116\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:15.846Z","host":{"name":"f6b540842a86"},"log":{"offset":572559,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a6ca50abb37e7fe348a065ab394bbacd4727c2e8b8e9e3bd5f262ec081d02f35"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765251127.568085\tCidHDxrvwqDDsLIN6\t202.46.62.83\t21924\t172.30.1.2\t443\ttcp\tssl\t0.862706\t1083\t19037\tRSTO\tF\tT\t0\tShADadfR\t19\t2067\t20\t20085\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:32:15.846Z","host":{"name":"f6b540842a86"},"log":{"offset":572685,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}