Kafdrop: Topic: logstash-local-network: Messages

Offset: 657424 Key: Timestamp: 2025-12-10 03:38:45.552 Headers: empty

{"@version":"1","event":{"hash":"6ed9c416aad456c756df9c731fdebefa7429b984acc9cf6776c25b45052c3bdd"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337913.519249\tCAssKa3F0JY8vk833k\t172.30.1.12\t41840\t8.8.8.8\t53\tudp\tdns\t0.028706\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:44.944Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":600206},"tags":["beats_input_codec_plain_applied"]}

Offset: 657425 Key: Timestamp: 2025-12-10 03:38:47.049 Headers: empty

{"@version":"1","event":{"hash":"3ecb98f286f284154b038b7483877296dba7be3988dcda8fddc69e0f50b1f4c1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337918.800650\tC8roPxSjXGBlUHnI6\t172.30.1.2\t60010\t172.30.4.136\t5044\ttcp\t-\t2.998438\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:45.944Z","host":{"name":"f6b540842a86"},"log":{"offset":600330,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657426 Key: Timestamp: 2025-12-10 03:38:47.049 Headers: empty

{"@version":"1","event":{"hash":"a87b1eb9759d8c413b8c18e2eb2902677ea30778ddb0871e0fb6dd1bbf6414c0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337919.600091\tC6OHfhyKHSJK4QGq\t172.30.1.2\t52340\t172.30.4.139\t1514\ttcp\t-\t2.998986\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:45.944Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":600454},"tags":["beats_input_codec_plain_applied"]}

Offset: 657427 Key: Timestamp: 2025-12-10 03:38:48.047 Headers: empty

{"@version":"1","event":{"hash":"eb1aab04106e501eb8acfac3506f4995b6c7da5161bd2949da988e4b5f21cdfa"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337915.599263\tCXFmeJ3KKmRYZ6zMC2\t172.30.1.12\t36708\t8.8.8.8\t53\tudp\tdns\t0.027940\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:46.944Z","host":{"name":"f6b540842a86"},"log":{"offset":600700,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657428 Key: Timestamp: 2025-12-10 03:38:48.047 Headers: empty

{"@version":"1","event":{"hash":"ec5de052b96541eaad6c3373cd9ef27d689ead290777023ed9320923848b9bf3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337914.559267\tCT9E56vHZPqMmlHtb\t172.30.1.12\t38230\t8.8.8.8\t53\tudp\tdns\t0.029933\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:46.944Z","host":{"name":"f6b540842a86"},"log":{"offset":600577,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657429 Key: Timestamp: 2025-12-10 03:38:48.047 Headers: empty

{"@version":"1","event":{"hash":"587c4114bc40a7e8ff08071d984418ba26bb7ad2c12669d6fc63e0b119751a9e"},"ecs":{"version":"1.6.0"},"message":"1765337926.546139\tClPfA04usYW6xlIKLk\t172.30.1.35\t64974\t172.30.1.254\t53\tudp\t1832\t0.004454\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1870.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:47.449Z","host":{"name":"f6b540842a86"},"log":{"offset":601793,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657430 Key: Timestamp: 2025-12-10 03:38:51.048 Headers: empty

{"@version":"1","event":{"hash":"387c250a3888f6a64ece6181543baa00d6d617ab5c9967229bbe3f913b14f9e7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337916.556142\tCBEimu2FAENShcPZqb\t172.30.1.35\t54664\t172.30.1.254\t53\tudp\tdns\t0.004486\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:49.945Z","host":{"name":"f6b540842a86"},"log":{"offset":600824,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657431 Key: Timestamp: 2025-12-10 03:38:51.048 Headers: empty

{"@version":"1","event":{"hash":"7a4ffb5f58ab1c52e90d035acac98e282931e5c884970bb9c50c63a2248ef2c6"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337917.669273\tCaW0tlbIs9WsgV71g\t172.30.1.12\t49315\t8.8.8.8\t53\tudp\tdns\t0.027533\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:49.945Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":601204},"tags":["beats_input_codec_plain_applied"]}

Offset: 657432 Key: Timestamp: 2025-12-10 03:38:51.049 Headers: empty

{"@version":"1","event":{"hash":"4c91c2bc3c64ab8dc0962325b831e20684ac7e18d71742a5be91982fea9a71f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337922.600084\tCaXa5T2s9QmPTGzFZ4\t172.30.1.2\t58618\t172.30.4.139\t1515\ttcp\t-\t2.999012\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:49.945Z","host":{"name":"f6b540842a86"},"log":{"offset":601079,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657433 Key: Timestamp: 2025-12-10 03:38:51.049 Headers: empty

{"@version":"1","event":{"hash":"a1e2b42cc60f96195296250b300fb2d2e9191db295e67c2477b81288591583ce"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337867.862746\tCi38kt4Af3xz8WVrA2\t172.30.1.132\t34645\t216.239.35.12\t123\tudp\tntp\t0.030437\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:49.945Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":601327},"tags":["beats_input_codec_plain_applied"]}

Offset: 657434 Key: Timestamp: 2025-12-10 03:38:51.049 Headers: empty

{"@version":"1","event":{"hash":"97aabad55929850bd105a25716333696d4ef7193f1d967f2a580aca1ee11c4b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337916.629266\tCc3wOD4jK3ru3GQdY7\t172.30.1.12\t42969\t8.8.8.8\t53\tudp\tdns\t0.029983\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:49.945Z","host":{"name":"f6b540842a86"},"log":{"offset":600955,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657435 Key: Timestamp: 2025-12-10 03:38:51.049 Headers: empty

{"@version":"1","event":{"hash":"9ccf4ba2aedb8fea3d6cb0399923086c6ede9df409c130cfbfbe27ca6fdd382e"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337918.699299\tCm85O52uyPgMmSi8S4\t172.30.1.12\t44507\t8.8.8.8\t53\tudp\tdns\t0.028482\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:50.946Z","host":{"name":"f6b540842a86"},"log":{"offset":601459,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657436 Key: Timestamp: 2025-12-10 03:38:51.049 Headers: empty

{"@version":"1","event":{"hash":"d61d2e01e9ee1632ab6f7524a3dcabc7d6cb197de2ca1fe4e4862f7a3fe8d300"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337923.611035\tCfZk1SAJtG61mo2th\t10.10.10.1\t33242\t10.10.10.203\t8000\ttcp\t-\t0.638920\t36\t0\tSH\tT\tT\t0\tSADF\t6\t356\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:50.946Z","host":{"name":"f6b540842a86"},"log":{"offset":601583,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657437 Key: Timestamp: 2025-12-10 03:38:53.053 Headers: empty

{"@version":"1","event":{"hash":"e209f13250a1a26412ed6835517d80d2f84f43f394223c8e2ce7e64f1be30bd4"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337922.974774\tC5dguo1N0aaFzqUDg8\t172.30.1.12\t40935\t61.90.207.93\t9090\ttcp\t-\t2.027918\t2096\t1275\tSF\tT\tF\t0\tShADadFf\t9\t2572\t5\t1543\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:51.946Z","host":{"name":"f6b540842a86"},"log":{"offset":601834,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657438 Key: Timestamp: 2025-12-10 03:38:53.053 Headers: empty

{"@version":"1","event":{"hash":"13bea96dbd75e21ab83817c82a4c9fada7ee372311ac88bb9e3eb27525065c07"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337919.739293\tCDeqdf24IKhOp8wzf\t172.30.1.12\t44513\t8.8.8.8\t53\tudp\tdns\t0.028510\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:51.946Z","host":{"name":"f6b540842a86"},"log":{"offset":601711,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657439 Key: Timestamp: 2025-12-10 03:38:54.050 Headers: empty

{"@version":"1","event":{"hash":"55798c7762d127a8d8db213c6a4eb28dc196d60e51683ab96976fd877ddaa281"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337925.909970\tCpGww91c4AsMg6Str4\t10.10.10.1\t33244\t10.10.10.203\t8000\ttcp\t-\t0.272632\t32\t0\tSH\tT\tT\t0\tSADF\t5\t300\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:52.947Z","host":{"name":"f6b540842a86"},"log":{"offset":601977,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657440 Key: Timestamp: 2025-12-10 03:38:54.050 Headers: empty

{"@version":"1","event":{"hash":"5e2feddd84e466a8bb7e62dde3f9711a528f9d7f629eac5f13c6d4f4013a2586"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337920.779486\tCIvgyv4qPIkUJs9m4c\t172.30.1.12\t50867\t8.8.8.8\t53\tudp\tdns\t0.027412\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:52.947Z","host":{"name":"f6b540842a86"},"log":{"offset":602106,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657441 Key: Timestamp: 2025-12-10 03:38:54.050 Headers: empty

{"@version":"1","event":{"hash":"e1357ac07c83ec5dc13bfc666c982d0a27655d9229bf02510260d6c10bd74752"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337921.554662\tCAKleW19V9RKt7olX1\t172.30.1.35\t64709\t172.30.1.254\t53\tudp\tdns\t0.004806\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:52.947Z","host":{"name":"f6b540842a86"},"log":{"offset":602230,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657442 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"b3733bc32902efd55683ba5087dcd98554936774cc0c419cc3eb296c7b45aebb"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337921.809343\tCePyzhYq6cgmnsya3\t172.30.1.12\t44905\t8.8.8.8\t53\tudp\tdns\t0.027707\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:53.947Z","host":{"name":"f6b540842a86"},"log":{"offset":602361,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657443 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"27947c515856d901fee8b7518587f2b40a20107390198b72b38c84b59d2c49b2"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337922.873764\tCW6Hp74gp2L50znii8\t172.30.1.12\t50625\t8.8.8.8\t53\tudp\tdns\t0.028627\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:53.947Z","host":{"name":"f6b540842a86"},"log":{"offset":602484,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657444 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"296b672f2675e5bf96f9c396824562359b5d4ba81d4ba5fcd23d75a446a2d4d9"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337922.915094\tC8qyuv1wIBMkUiAa09\t172.30.1.12\t47314\t8.8.8.8\t53\tudp\tdns\t0.027827\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:53.947Z","host":{"name":"f6b540842a86"},"log":{"offset":602608,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657445 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"e28663d2d40276f423be935f8eece86b31516ca3a54026b098ba5fa39a082428"},"ecs":{"version":"1.6.0"},"message":"1765337930.389660\tCxWtav3yF59dzOvMhh\t172.30.1.12\t52759\t8.8.8.8\t53\tudp\t55587\t0.029567\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t202.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.450Z","host":{"name":"f6b540842a86"},"log":{"offset":601966,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657446 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"ab6d352e2bcec95045e126760bf104b9299f1e6ac43d8e2f79d2acc94485590c"},"ecs":{"version":"1.6.0"},"message":"1765337931.429413\tCUBW48DgTXHiN65X6\t172.30.1.12\t60914\t8.8.8.8\t53\tudp\t55588\t0.027948\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t287.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.450Z","host":{"name":"f6b540842a86"},"log":{"offset":602141,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657447 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"5fa064d4c841ef00214b5da24d9be8eb02967be131b69fbf183fab701a768ea6"},"ecs":{"version":"1.6.0"},"message":"1765337931.556468\tCPjkzR3fNJrapFrBUe\t172.30.1.35\t53998\t172.30.1.254\t53\tudp\t26001\t0.004559\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1865.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.450Z","host":{"name":"f6b540842a86"},"log":{"offset":602315,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657448 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"d67e598f12b49e5acef480b42d4cd0ad56e9e37f56f51a19086a1ab435b056af"},"ecs":{"version":"1.6.0"},"message":"1765337932.459399\tC2fOBx3WN8aYp4Ty\t172.30.1.12\t46837\t8.8.8.8\t53\tudp\t55589\t0.028851\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t200.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.450Z","host":{"name":"f6b540842a86"},"log":{"offset":602489,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657449 Key: Timestamp: 2025-12-10 03:38:55.051 Headers: empty

{"@version":"1","event":{"hash":"30487a159ccae1b58dbad5d25cbb45566ed8cd4e52a489c2c8153099cfec6e5a"},"ecs":{"version":"1.6.0"},"message":"1765337933.499539\tCF45CehMN3Mq3DbTc\t172.30.1.12\t60349\t8.8.8.8\t53\tudp\t55590\t0.027944\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t41.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.450Z","host":{"name":"f6b540842a86"},"log":{"offset":602662,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657450 Key: Timestamp: 2025-12-10 03:38:56.053 Headers: empty

{"@version":"1","event":{"hash":"f212226c8d2cba2d450ee717f987b907d0a84e2ad56cc6797e6e31c93fd10b38"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337922.839492\tCRVGFMQZ1LTEa8pN3\t172.30.1.12\t33294\t8.8.8.8\t53\tudp\tdns\t0.026612\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.948Z","host":{"name":"f6b540842a86"},"log":{"offset":602732,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657451 Key: Timestamp: 2025-12-10 03:38:56.053 Headers: empty

{"@version":"1","event":{"hash":"138e99cfeb33d96dae7ff196edb5ab4492f1c5f1a0b2b0599829df4397d1699f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337922.945177\tCM42F52CjbkgVwl973\t172.30.1.12\t33203\t8.8.8.8\t53\tudp\tdns\t0.028943\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:54.948Z","host":{"name":"f6b540842a86"},"log":{"offset":602855,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657452 Key: Timestamp: 2025-12-10 03:38:56.053 Headers: empty

{"@version":"1","event":{"hash":"f29919b443fc0e50d005f7d44581515f33c9c5e2922b5e06c4befb6ced245af2"},"ecs":{"version":"1.6.0"},"message":"1765337934.529561\tCPqZy32AjUjgXXgFO6\t172.30.1.12\t47266\t8.8.8.8\t53\tudp\t55591\t0.027700\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t284.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:55.450Z","host":{"name":"f6b540842a86"},"log":{"offset":602835,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657453 Key: Timestamp: 2025-12-10 03:38:57.052 Headers: empty

{"@version":"1","event":{"hash":"6cd823eef7bae2c711cde6cb6acebe3352fadc237fa6b9fe3892bbd5aa6a9330"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337871.533877\tCuCOdE3froyBU7hj76\t172.30.1.222\t55762\t239.255.255.250\t1900\tudp\t-\t3.020943\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:55.949Z","host":{"name":"f6b540842a86"},"log":{"offset":602979,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657454 Key: Timestamp: 2025-12-10 03:38:57.052 Headers: empty

{"@version":"1","event":{"hash":"778f039c3041110a66b8a048b6c55609dcc8cfe594d0754748863fa5aca2caaa"},"ecs":{"version":"1.6.0"},"message":"1765337935.559500\tCgDUBXN91Ykxfqoh4\t172.30.1.12\t44889\t8.8.8.8\t53\tudp\t55592\t0.031255\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t39.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:56.451Z","host":{"name":"f6b540842a86"},"log":{"offset":603010,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657455 Key: Timestamp: 2025-12-10 03:38:58.555 Headers: empty

{"@version":"1","event":{"hash":"fea9593b28f5444e2c9b204edafe43c48ec5aaaa48903bb20a19a3ffcafe39e3"},"ecs":{"version":"1.6.0"},"message":"1765337936.344156\tClPkYG2SZg5HOdAUF7\t172.30.1.35\t64914\t172.30.1.254\t53\tudp\t7682\t0.002976\tssl.gstatic.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t142.250.204.131\t183.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:57.451Z","host":{"name":"f6b540842a86"},"log":{"offset":603183,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657456 Key: Timestamp: 2025-12-10 03:38:58.555 Headers: empty

{"@version":"1","event":{"hash":"fd285e5f13949a53cf2de55b5b6a00e91155eb34afaee6071f9e3277cda21152"},"ecs":{"version":"1.6.0"},"message":"1765337936.344049\tCiAnDo1U6drzJQvM11\t172.30.1.35\t53105\t172.30.1.254\t53\tudp\t57876\t-\tssl.gstatic.com\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:57.451Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":603354},"tags":["beats_input_codec_plain_applied"]}

Offset: 657457 Key: Timestamp: 2025-12-10 03:38:59.560 Headers: empty

{"@version":"1","event":{"hash":"739668be698af6f80321f8a5b77b4cec54abde9e0742197db8c41b1b000cbeaa"},"ecs":{"version":"1.6.0"},"message":"1765337936.612426\tCvxKZxc089e0Kky41\t172.30.1.35\t59478\t8.8.8.8\t53\tudp\t11627\t0.008447\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1902.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:58.453Z","host":{"name":"f6b540842a86"},"log":{"offset":603677,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657458 Key: Timestamp: 2025-12-10 03:38:59.560 Headers: empty

{"@version":"1","event":{"hash":"97d99011974fec16cac8e30ac81e809135935313bb8231d72b37d82d3d84825f"},"ecs":{"version":"1.6.0"},"message":"1765337936.550278\tCM4Y0Ei93h6zLcY1g\t172.30.1.35\t59478\t172.30.1.254\t53\tudp\t11627\t0.627450\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1859.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:58.453Z","host":{"name":"f6b540842a86"},"log":{"offset":603504,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657459 Key: Timestamp: 2025-12-10 03:38:59.560 Headers: empty

{"@version":"1","event":{"hash":"96a49865753a15828c7450d7b3afb9248096429c7507d38a7c1084b6b7d3f243"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337926.546139\tClPfA04usYW6xlIKLk\t172.30.1.35\t64974\t172.30.1.254\t53\tudp\tdns\t0.004454\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:58.950Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":603111},"tags":["beats_input_codec_plain_applied"]}

Offset: 657460 Key: Timestamp: 2025-12-10 03:38:59.560 Headers: empty

{"@version":"1","event":{"hash":"6b97a04968a0702b5afd3ec8029a72c4575759d70dd89b6d184e603771cd92de"},"ecs":{"version":"1.6.0"},"message":"1765337936.612426\tCMBO481Aj8vIcymk7l\t172.30.1.12\t55551\t8.8.8.8\t53\tudp\t55593\t0.015786\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t38.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:58.453Z","host":{"name":"f6b540842a86"},"log":{"offset":603845,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657461 Key: Timestamp: 2025-12-10 03:39:00.557 Headers: empty

{"@version":"1","event":{"hash":"351e8eb1160a367d64fad11361010e823a1701f96aea7d943b034c71ed08c406"},"ecs":{"version":"1.6.0"},"message":"1765337937.639591\tCwJjXU1rYAWcWMpBO\t172.30.1.12\t60604\t8.8.8.8\t53\tudp\t55594\t0.028686\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t281.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:59.453Z","host":{"name":"f6b540842a86"},"log":{"offset":604019,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657462 Key: Timestamp: 2025-12-10 03:39:00.557 Headers: empty

{"@version":"1","event":{"hash":"8ddd742e3cff8474779fbfbf47f894a088a759eb8c9f5dc1d59a23108c2f71c4"},"ecs":{"version":"1.6.0"},"message":"1765337938.679531\tCGXyET3dPPzKfAK46b\t172.30.1.12\t46142\t8.8.8.8\t53\tudp\t55595\t0.028808\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t280.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:38:59.453Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":604193},"tags":["beats_input_codec_plain_applied"]}

Offset: 657463 Key: Timestamp: 2025-12-10 03:39:03.054 Headers: empty

{"@version":"1","event":{"hash":"d836b05c0ddc69b6c6b1825146dccf85c693681163193709a7cd1be86e52a490"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337935.603396\tCWsFyw4CQsBsSHSuAl\t172.30.1.2\t52344\t172.30.4.139\t1514\ttcp\t-\t3.004086\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:01.950Z","host":{"name":"f6b540842a86"},"log":{"offset":603242,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657464 Key: Timestamp: 2025-12-10 03:39:03.054 Headers: empty

{"@version":"1","event":{"hash":"dea2fb4b2a9ed851007373b2ba95f75c9b86e0bcae802293c6ec7ed1ae9ed520"},"ecs":{"version":"1.6.0"},"message":"1765337939.719507\tCTKqOj30sRoByQaeBa\t172.30.1.12\t46650\t8.8.8.8\t53\tudp\t55596\t0.027478\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t35.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:02.457Z","host":{"name":"f6b540842a86"},"log":{"offset":604368,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657465 Key: Timestamp: 2025-12-10 03:39:03.054 Headers: empty

{"@version":"1","event":{"hash":"6ee0c4d3a8faf7ecfae0eeebdf079d47fadb54fa6f78abee76d491365c649b6d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337930.389660\tCxWtav3yF59dzOvMhh\t172.30.1.12\t52759\t8.8.8.8\t53\tudp\tdns\t0.029567\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:01.950Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":603367},"tags":["beats_input_codec_plain_applied"]}

Offset: 657466 Key: Timestamp: 2025-12-10 03:39:03.054 Headers: empty

{"@version":"1","event":{"hash":"5672cd5c78df834b1726e1160d5030b862cae786d086ea65f71da81cad498949"},"ecs":{"version":"1.6.0"},"message":"1765337940.749770\tC3bvEY3UQDXvANSBZ8\t172.30.1.12\t33241\t8.8.8.8\t53\tudp\t55597\t0.027843\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t192.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:02.457Z","host":{"name":"f6b540842a86"},"log":{"offset":604542,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657467 Key: Timestamp: 2025-12-10 03:39:04.055 Headers: empty

{"@version":"1","event":{"hash":"5a9b5312f5ad9a76f2b88f837622e6ec0bce28974ed580a4fe95c0a62c6bbe87"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337931.429413\tCUBW48DgTXHiN65X6\t172.30.1.12\t60914\t8.8.8.8\t53\tudp\tdns\t0.027948\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:02.951Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":603491},"tags":["beats_input_codec_plain_applied"]}

Offset: 657468 Key: Timestamp: 2025-12-10 03:39:04.055 Headers: empty

{"@version":"1","event":{"hash":"d3812d4572e206fee7f54f4c16cc65d7825ae97c22241c670e44e72ca5cea37a"},"ecs":{"version":"1.6.0"},"message":"1765337941.557163\tCQHmN4kYT6ZBMITIa\t172.30.1.35\t51695\t172.30.1.254\t53\tudp\t44910\t0.005399\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1855.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:03.457Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":604717},"tags":["beats_input_codec_plain_applied"]}

Offset: 657469 Key: Timestamp: 2025-12-10 03:39:04.055 Headers: empty

{"@version":"1","event":{"hash":"522014479657b286fa66b3173259b1320fe7d2be982d67742c91dc4ab9cf5c81"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337931.556468\tCPjkzR3fNJrapFrBUe\t172.30.1.35\t53998\t172.30.1.254\t53\tudp\tdns\t0.004559\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:02.951Z","host":{"name":"f6b540842a86"},"log":{"offset":603614,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657470 Key: Timestamp: 2025-12-10 03:39:04.055 Headers: empty

{"@version":"1","event":{"hash":"5f7b3b42e4bf59c6e6a959a5b1a6433a870a64dc799179b9d8538967cab05fbc"},"ecs":{"version":"1.6.0"},"message":"1765337941.821515\tCmmJhJ3Y5fxuXt4Mo1\t172.30.1.12\t53638\t8.8.8.8\t53\tudp\t55598\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t228.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:03.457Z","host":{"name":"f6b540842a86"},"log":{"offset":604890,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657471 Key: Timestamp: 2025-12-10 03:39:05.561 Headers: empty

{"@version":"1","event":{"hash":"a0a3f7bdf510c2d8ed46c27f0551139391a5078d0d51659bc23ce3c73230c6cb"},"ecs":{"version":"1.6.0"},"message":"1765337942.809533\tCmPil04vVnQ4kHidLc\t172.30.1.12\t58809\t8.8.8.8\t53\tudp\t55599\t0.027444\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t276.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:04.458Z","host":{"name":"f6b540842a86"},"log":{"offset":605058,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657472 Key: Timestamp: 2025-12-10 03:39:06.561 Headers: empty

{"@version":"1","event":{"hash":"a75adc410bcaaadbf00e6b9d133006aa3150322afc41a3ecea8a036ba044d239"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337932.459399\tC2fOBx3WN8aYp4Ty\t172.30.1.12\t46837\t8.8.8.8\t53\tudp\tdns\t0.028851\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:05.951Z","host":{"name":"f6b540842a86"},"log":{"offset":603745,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657473 Key: Timestamp: 2025-12-10 03:39:06.561 Headers: empty

{"@version":"1","event":{"hash":"ab0b2b2341754275a444aeef2b13d06ad82f8b77ad52bb781a4cabaf878955cd"},"ecs":{"version":"1.6.0"},"message":"1765337943.839546\tCxYsSK2pymIYxOuRE6\t172.30.1.12\t56331\t8.8.8.8\t53\tudp\t55600\t0.026793\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t31.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:05.458Z","host":{"name":"f6b540842a86"},"log":{"offset":605233,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657474 Key: Timestamp: 2025-12-10 03:39:06.561 Headers: empty

{"@version":"1","event":{"hash":"5f62deb3ef7eb2d362f71dc9124740b32f49894829f291f447bc83448678fe6a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337933.499539\tCF45CehMN3Mq3DbTc\t172.30.1.12\t60349\t8.8.8.8\t53\tudp\tdns\t0.027944\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:05.951Z","host":{"name":"f6b540842a86"},"log":{"offset":603996,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657475 Key: Timestamp: 2025-12-10 03:39:06.561 Headers: empty

{"@version":"1","event":{"hash":"f4f8ab1445318ab47965ad353ee3d384f67c17430cb13acd526dcda2caf6e4aa"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337938.191675\tC53zfy1ACLc0cDwRjg\t10.10.10.1\t35830\t10.10.10.202\t8000\ttcp\t-\t0.034029\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:05.951Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":603867},"tags":["beats_input_codec_plain_applied"]}

Offset: 657476 Key: Timestamp: 2025-12-10 03:39:07.561 Headers: empty

{"@version":"1","event":{"hash":"1f76b49f4174867d5bcd86be95307ace3e9b7e0e2917237ea8af641c6ff8e0b3"},"ecs":{"version":"1.6.0"},"message":"1765337944.898226\tCiYnULD5AeaW9ccd4\t172.30.1.12\t59120\t8.8.8.8\t53\tudp\t55602\t0.027505\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t30.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:06.458Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":605407},"tags":["beats_input_codec_plain_applied"]}

Offset: 657477 Key: Timestamp: 2025-12-10 03:39:07.561 Headers: empty

{"@version":"1","event":{"hash":"62ed790e37ef5ce0119f16685adf0844887c1801fd75879db9597497d20dfdab"},"ecs":{"version":"1.6.0"},"message":"1765337944.869554\tCxrL0U3ZphCHlwyYz4\t172.30.1.12\t55471\t8.8.8.8\t53\tudp\t55601\t0.027126\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t188.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:06.458Z","host":{"name":"f6b540842a86"},"log":{"offset":605580,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657478 Key: Timestamp: 2025-12-10 03:39:07.561 Headers: empty

{"@version":"1","event":{"hash":"4bfc45512d73f5b3c96a076df85f22a96c26e07006c6da0f1c83082ee9148653"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337934.529561\tCPqZy32AjUjgXXgFO6\t172.30.1.12\t47266\t8.8.8.8\t53\tudp\tdns\t0.027700\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:06.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":604119},"tags":["beats_input_codec_plain_applied"]}

Offset: 657479 Key: Timestamp: 2025-12-10 03:39:08.562 Headers: empty

{"@version":"1","event":{"hash":"005878fff9f5eba96e2d98079800047f1cd2847e1c852ea5b26ad17d3098287c"},"ecs":{"version":"1.6.0"},"message":"1765337945.929577\tCXwnQT3JRKDJOyzVmb\t172.30.1.12\t50783\t8.8.8.8\t53\tudp\t55603\t0.028682\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t29.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.459Z","host":{"name":"f6b540842a86"},"log":{"offset":605755,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657480 Key: Timestamp: 2025-12-10 03:39:08.563 Headers: empty

{"@version":"1","event":{"hash":"74c7f954bf41f1166e694825e64349b2e06dd8a2f88b6504db9a557e952a3723"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337935.559500\tCgDUBXN91Ykxfqoh4\t172.30.1.12\t44889\t8.8.8.8\t53\tudp\tdns\t0.031255\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.952Z","host":{"name":"f6b540842a86"},"log":{"offset":604243,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657481 Key: Timestamp: 2025-12-10 03:39:08.563 Headers: empty

{"@version":"1","event":{"hash":"ffa157424c87c30da580db429cd4f7e819900e6e9af3feb176f4ff1491c7c675"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337936.550278\tCM4Y0Ei93h6zLcY1g\t172.30.1.35\t59478\t172.30.1.254\t53\tudp\tdns\t0.627450\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.952Z","host":{"name":"f6b540842a86"},"log":{"offset":604366,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657482 Key: Timestamp: 2025-12-10 03:39:08.563 Headers: empty

{"@version":"1","event":{"hash":"a668a5eb56ddadf3c9a2253b792201719df1c5ec11def2cb8fd7e6011082cbaa"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337936.344156\tClPkYG2SZg5HOdAUF7\t172.30.1.35\t64914\t172.30.1.254\t53\tudp\tdns\t0.002976\t33\t49\tSF\tT\tT\t0\tDd\t1\t61\t1\t77\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":604496},"tags":["beats_input_codec_plain_applied"]}

Offset: 657483 Key: Timestamp: 2025-12-10 03:39:08.563 Headers: empty

{"@version":"1","event":{"hash":"56146b824628770d4951bfd33141458ded76030901d1eb19889f3588b978e9ff"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337936.592141\tCvxKZxc089e0Kky41\t172.30.1.35\t59478\t8.8.8.8\t53\tudp\tdns\t0.028732\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.952Z","host":{"name":"f6b540842a86"},"log":{"offset":604625,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657484 Key: Timestamp: 2025-12-10 03:39:08.563 Headers: empty

{"@version":"1","event":{"hash":"b3ffebcb8dde9377d682e413e4683f6d6539d58d2bd6ee4d77d28ae164680459"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337936.599473\tCMBO481Aj8vIcymk7l\t172.30.1.12\t55551\t8.8.8.8\t53\tudp\tdns\t0.028739\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:07.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":604750},"tags":["beats_input_codec_plain_applied"]}

Offset: 657485 Key: Timestamp: 2025-12-10 03:39:09.563 Headers: empty

{"@version":"1","event":{"hash":"ea43cfb492b002a0348a5b5fd9468105eb7990b96a0408bcbfe15fbc9b59e827"},"ecs":{"version":"1.6.0"},"message":"1765337946.554765\tCFVZ1d4P8np1yg0hK1\t172.30.1.35\t52475\t172.30.1.254\t53\tudp\t4551\t0.150773\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1018.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:08.459Z","host":{"name":"f6b540842a86"},"log":{"offset":605929,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657486 Key: Timestamp: 2025-12-10 03:39:09.563 Headers: empty

{"@version":"1","event":{"hash":"e10e4772c3d93a8afe34cffd7ce3cda1cf13ce533c685d0c66d24a6a42b7f327"},"ecs":{"version":"1.6.0"},"message":"1765337946.593804\tC54Vjx1ZKk7E1gGR9c\t172.30.1.35\t52475\t8.8.8.8\t53\tudp\t4551\t0.029791\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t398.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:08.459Z","host":{"name":"f6b540842a86"},"log":{"offset":606102,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657487 Key: Timestamp: 2025-12-10 03:39:09.563 Headers: empty

{"@version":"1","event":{"hash":"2aecc58a9fa124b88d95e989e22ee10aa5c6cc0a99b525f6cb88fa8e3dc4ef55"},"ecs":{"version":"1.6.0"},"message":"1765337946.969561\tCdyiPF2MdGHc5wkOHg\t172.30.1.12\t35638\t8.8.8.8\t53\tudp\t55604\t0.027559\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t28.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:08.459Z","host":{"name":"f6b540842a86"},"log":{"offset":606269,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657488 Key: Timestamp: 2025-12-10 03:39:09.563 Headers: empty

{"@version":"1","event":{"hash":"39a4a53acb0cd88cc478160079c6805bd9c523c40f8d90258bb1cbda8078fd06"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337936.344049\tCiAnDo1U6drzJQvM11\t172.30.1.35\t53105\t172.30.1.254\t53\tudp\tdns\t0.003413\t33\t90\tSF\tT\tT\t0\tDd\t1\t61\t1\t118\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:08.953Z","host":{"name":"f6b540842a86"},"log":{"offset":604874,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657489 Key: Timestamp: 2025-12-10 03:39:09.563 Headers: empty

{"@version":"1","event":{"hash":"27f0f302aa7cd5f77ab474775145a1c240e318a6fd2a4601dfc02cefac6a07d0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337937.639591\tCwJjXU1rYAWcWMpBO\t172.30.1.12\t60604\t8.8.8.8\t53\tudp\tdns\t0.028686\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:08.953Z","host":{"name":"f6b540842a86"},"log":{"offset":605004,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657490 Key: Timestamp: 2025-12-10 03:39:10.567 Headers: empty

{"@version":"1","event":{"hash":"9f0521f2e462d7dd5eb26c88d5208d1e585495e4bc822f3ecafd4caa24ae0c2a"},"ecs":{"version":"1.6.0"},"message":"1765337948.003892\tCWghKEzdpKJUkR5Kg\t172.30.1.12\t52063\t8.8.8.8\t53\tudp\t55605\t0.024857\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t26.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:09.461Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":606443},"tags":["beats_input_codec_plain_applied"]}

Offset: 657491 Key: Timestamp: 2025-12-10 03:39:10.567 Headers: empty

{"@version":"1","event":{"hash":"77486102c9f01e1a60b5a5ff15efa81982792fc8e0c5807f42431821b9d1f860"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337884.704915\tC3a4uh1OcRFO7v1TRf\t172.30.1.98\t65270\t239.255.255.250\t1900\tudp\t-\t3.043225\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:09.953Z","host":{"name":"f6b540842a86"},"log":{"offset":605127,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657492 Key: Timestamp: 2025-12-10 03:39:11.568 Headers: empty

{"@version":"1","event":{"hash":"a0267f483fa9364e3966597598fe3f38dd5067c901bc7e6a50e6680cd2060e1c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337939.719507\tCTKqOj30sRoByQaeBa\t172.30.1.12\t46650\t8.8.8.8\t53\tudp\tdns\t0.027478\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:10.953Z","host":{"name":"f6b540842a86"},"log":{"offset":605382,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657493 Key: Timestamp: 2025-12-10 03:39:11.568 Headers: empty

{"@version":"1","event":{"hash":"b94abd306d2a220cc351a079f0d533a5f5e54d701efebca1a8978217c5aa1066"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337938.679531\tCGXyET3dPPzKfAK46b\t172.30.1.12\t46142\t8.8.8.8\t53\tudp\tdns\t0.028808\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:10.953Z","host":{"name":"f6b540842a86"},"log":{"offset":605258,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657494 Key: Timestamp: 2025-12-10 03:39:11.568 Headers: empty

{"@version":"1","event":{"hash":"af0297072596d7223026697b7a013f226202f9650c20c6648ceaf51678064fc7"},"ecs":{"version":"1.6.0"},"message":"1765337949.039684\tC7Yn7d308lRSydylQf\t172.30.1.12\t53501\t8.8.8.8\t53\tudp\t55606\t0.029566\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t183.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:10.461Z","host":{"name":"f6b540842a86"},"log":{"offset":606616,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657495 Key: Timestamp: 2025-12-10 03:39:12.573 Headers: empty

{"@version":"1","event":{"hash":"f7427c12260831c56ee2a05aefc907e8602d43c052334609ea3bc001daff2ff3"},"ecs":{"version":"1.6.0"},"message":"1765337950.079738\tC34zTY1ZhSHregJmje\t172.30.1.12\t50733\t8.8.8.8\t53\tudp\t55607\t0.027103\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t24.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:11.465Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":606791},"tags":["beats_input_codec_plain_applied"]}

Offset: 657496 Key: Timestamp: 2025-12-10 03:39:12.573 Headers: empty

{"@version":"1","event":{"hash":"29596902fe9003a6da25416860a53b1e2008f2256fd03f059a58b9dce07d17bb"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337940.749770\tC3bvEY3UQDXvANSBZ8\t172.30.1.12\t33241\t8.8.8.8\t53\tudp\tdns\t0.027843\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:11.954Z","host":{"name":"f6b540842a86"},"log":{"offset":605506,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657497 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"615590c53f9254f74d82fe24b526eb8fc647cececa92ee085af03698bd2b64b9"},"ecs":{"version":"1.6.0"},"message":"1765337937.943052\tCjprSy12rMaNW92Mf5\t172.30.1.15\t137\t172.30.1.255\t137\tudp\t833\t-\tWORKGROUP\t1\tC_INTERNET\t32\tNB\t-\t-\tF\tF\tF\tF\t1\t-\t-\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"offset":607352,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657498 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"e29b26b6f6d983cc30da5154a0dd0fbe7a9befe293a60025f5b9ea57f30dd829"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337931.820077\tCjprSy12rMaNW92Mf5\t172.30.1.15\t137\t172.30.1.255\t137\tudp\tdns\t6.122975\t200\t0\tS0\tT\tT\t0\tD\t4\t312\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.954Z","host":{"name":"f6b540842a86"},"log":{"offset":605630,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657499 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"6743ac28930c5641d4182207259daa643e35ad4f088bd209fc33d5b323a39909"},"ecs":{"version":"1.6.0"},"message":"1765337951.591828\tCKZeyVtaS6erhQlnf\t172.30.1.35\t51979\t8.8.8.8\t53\tudp\t21329\t0.028473\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2418.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"offset":607656,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657500 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"2a94e281b0dea365ace0094da7ac0c9928e95510bdaa5ee9ba565e9077f88ae2"},"ecs":{"version":"1.6.0"},"message":"1765337931.820077\tCjprSy12rMaNW92Mf5\t172.30.1.15\t137\t172.30.1.255\t137\tudp\t833\t-\tWORKGROUP\t1\tC_INTERNET\t32\tNB\t-\t-\tF\tF\tF\tF\t1\t-\t-\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"offset":606965,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657501 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"19c63b1e619936967c6df07ab19c8268fec51613b60806b86585d95af39ad425"},"ecs":{"version":"1.6.0"},"message":"1765337933.860826\tCjprSy12rMaNW92Mf5\t172.30.1.15\t137\t172.30.1.255\t137\tudp\t833\t-\tWORKGROUP\t1\tC_INTERNET\t32\tNB\t-\t-\tF\tF\tF\tF\t1\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":607094},"tags":["beats_input_codec_plain_applied"]}

Offset: 657502 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"9c39fe5a7f1f658f0e1de4a5dba4fed909a3faefc4bac795e56f727855d96166"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337941.779667\tCmmJhJ3Y5fxuXt4Mo1\t172.30.1.12\t53638\t8.8.8.8\t53\tudp\tdns\t0.027214\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.954Z","host":{"name":"f6b540842a86"},"log":{"offset":605757,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657503 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"78afeb043cf8eef8a93aaffb7ac1bdf398cfe183a7abafda4f25f915c7cbd830"},"ecs":{"version":"1.6.0"},"message":"1765337935.929428\tCjprSy12rMaNW92Mf5\t172.30.1.15\t137\t172.30.1.255\t137\tudp\t833\t-\tWORKGROUP\t1\tC_INTERNET\t32\tNB\t-\t-\tF\tF\tF\tF\t1\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"offset":607223,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657504 Key: Timestamp: 2025-12-10 03:39:13.594 Headers: empty

{"@version":"1","event":{"hash":"ad788e0245d6dd7d90a17ddfdae0fa33b0207041d84b117b1ca74f7b9ddbbd52"},"ecs":{"version":"1.6.0"},"message":"1765337951.109643\tCSrcIq3bT5YgUWCqV3\t172.30.1.12\t38081\t8.8.8.8\t53\tudp\t55608\t0.027663\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t267.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:12.471Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":607481},"tags":["beats_input_codec_plain_applied"]}

Offset: 657505 Key: Timestamp: 2025-12-10 03:39:14.594 Headers: empty

{"@version":"1","event":{"hash":"e0632a06edce80b7537de424f49c2c301099d903a999e494d7826a5c0d190d50"},"ecs":{"version":"1.6.0"},"message":"1765337952.139661\tC1v6Ls4ffcVTvpqGUa\t172.30.1.12\t50352\t8.8.8.8\t53\tudp\t55609\t0.026648\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t180.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:13.491Z","host":{"name":"f6b540842a86"},"log":{"offset":607824,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657506 Key: Timestamp: 2025-12-10 03:39:14.594 Headers: empty

{"@version":"1","event":{"hash":"ce3ef0868b3e98aa821fdf29946b917a3e2409d0dcbf84352dedf4f6a507b0a6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337941.557163\tCQHmN4kYT6ZBMITIa\t172.30.1.35\t51695\t172.30.1.254\t53\tudp\tdns\t0.005399\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:13.955Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":605881},"tags":["beats_input_codec_plain_applied"]}

Offset: 657507 Key: Timestamp: 2025-12-10 03:39:14.594 Headers: empty

{"@version":"1","event":{"hash":"09b2397d536a0af3150849543cf9e4a54b7d6b84f21c55c4761d6b8a74a5daaf"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337942.809533\tCmPil04vVnQ4kHidLc\t172.30.1.12\t58809\t8.8.8.8\t53\tudp\tdns\t0.027444\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:13.955Z","host":{"name":"f6b540842a86"},"log":{"offset":606011,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657508 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"4bd4c1e64d28efdc3c6f6de27a4a6b4fada45b49be8dc5f5346611a2a380d8b3"},"ecs":{"version":"1.6.0"},"message":"1765337951.552956\tCnyQiA3CSiCj164OE4\t172.30.1.35\t51979\t172.30.1.254\t53\tudp\t21329\t1.065333\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1012.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.491Z","host":{"name":"f6b540842a86"},"log":{"offset":607999,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657509 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"7ef93f1d93d3bae702908fe8795572f50aff6cd71669c6e62d54f8d73f3d0312"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337892.960569\tCWcHa42zsyP4c4H2T\t172.30.1.132\t3\t172.30.1.254\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tT\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.955Z","host":{"name":"f6b540842a86"},"log":{"offset":606135,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657510 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"a921a8f73a27032a4bb3152a8f973761de63a43ec6829d9c44c38feb9a741923"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337948.157592\tCeEVla3BBnAkGW6kr1\t172.30.1.35\t52190\t172.30.2.17\t7680\ttcp\t-\t0.002826\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.955Z","host":{"name":"f6b540842a86"},"log":{"offset":606248,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657511 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"dacf9cf309f97a32a0e9118107d0beabac893cd5546e06383774954a8b65cc4d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337948.612719\tCk2Fmu1ILzgCXCACb\t172.30.1.2\t52346\t172.30.4.139\t1514\ttcp\t-\t2.996392\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.955Z","host":{"name":"f6b540842a86"},"log":{"offset":606382,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657512 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"3c9d31c768a65accc72c0ea4262fa0ee45abaaf478c3cf38ebc9d668ffa9f23f"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337943.839546\tCxYsSK2pymIYxOuRE6\t172.30.1.12\t56331\t8.8.8.8\t53\tudp\tdns\t0.026793\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.955Z","host":{"name":"f6b540842a86"},"log":{"offset":606506,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657513 Key: Timestamp: 2025-12-10 03:39:15.599 Headers: empty

{"@version":"1","event":{"hash":"f16303d9cb2d92a10601dd975aaec0ec107ec527cc4933e0722c98b63feb10af"},"ecs":{"version":"1.6.0"},"message":"1765337953.169632\tCtxU2D7wj4yHRMqP3\t172.30.1.12\t37869\t8.8.8.8\t53\tudp\t55610\t0.029057\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t21.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:14.491Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":608173},"tags":["beats_input_codec_plain_applied"]}

Offset: 657514 Key: Timestamp: 2025-12-10 03:39:16.601 Headers: empty

{"@version":"1","event":{"hash":"6e464413e9e036b5c11e5e6bc7bb762ee6466a8e173b160a246cc14c1e06cc6d"},"ecs":{"version":"1.6.0"},"message":"1765337954.273435\tCfK59g2JzYpywLpgy4\t172.30.1.12\t54217\t8.8.8.8\t53\tudp\t55611\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t20.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:39:15.495Z","host":{"name":"f6b540842a86"},"log":{"offset":608346,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657515 Key: Timestamp: 2025-12-10 03:46:39.024 Headers: empty

{"@version":"1","event":{"hash":"182402f59fae55d89df410a38b453f427dd2f3dcc2fc4ce3aa1e2715fc048bc3"},"ecs":{"version":"1.6.0"},"message":"1765338395.734195\tCurw742AuoR8Juni73\t172.30.1.12\t51909\t8.8.8.8\t53\tudp\t56044\t0.037952\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t123.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:37.921Z","host":{"name":"f6b540842a86"},"log":{"offset":710212,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657516 Key: Timestamp: 2025-12-10 03:46:39.024 Headers: empty

{"@version":"1","event":{"hash":"b5080eb2cf05f5b9ea8fd415e01eb4b7ca58cacc0f3f2767e50150cdd06c01e0"},"ecs":{"version":"1.6.0"},"message":"1765338396.548029\tCRnGsb4smMi8k9vCGf\t172.30.1.35\t63700\t172.30.1.254\t53\tudp\t49155\t0.004692\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1400.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:37.921Z","host":{"name":"f6b540842a86"},"log":{"offset":710387,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657517 Key: Timestamp: 2025-12-10 03:46:39.025 Headers: empty

{"@version":"1","event":{"hash":"a95126635819812c8605bcbd71c9b9f732e695fd07411b84e70cbc40f25cc394"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338386.550581\tCjUOcI1IX5smUzTD3j\t172.30.1.35\t50478\t172.30.1.254\t53\tudp\tdns\t0.004794\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:38.408Z","host":{"name":"f6b540842a86"},"log":{"offset":713537,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657518 Key: Timestamp: 2025-12-10 03:46:39.025 Headers: empty

{"@version":"1","event":{"hash":"18d0f8965c1c28826306077c2439eb1a13bd011ebbf034e72c77889e5745e121"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338391.626932\tCGBWEh4i6H65bKivf\t172.30.1.35\t52208\t172.30.2.17\t7680\ttcp\t-\t0.002789\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:38.409Z","host":{"name":"f6b540842a86"},"log":{"offset":713668,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657519 Key: Timestamp: 2025-12-10 03:46:40.025 Headers: empty

{"@version":"1","event":{"hash":"673eccf1bd7974bbfd856f46939dcf1eb012157d8a91ee5e4f1ae3961d5d3917"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338387.413901\tCnEuv02dG6c0Q60ATc\t172.30.1.12\t57381\t8.8.8.8\t53\tudp\tdns\t0.028656\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:39.409Z","host":{"name":"f6b540842a86"},"log":{"offset":713801,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657520 Key: Timestamp: 2025-12-10 03:46:40.025 Headers: empty

{"@version":"1","event":{"hash":"03500098fd9a03a2be5b120872c8d382be59923c9398be6821941f121309548a"},"ecs":{"version":"1.6.0"},"message":"1765338396.764005\tCXy9Ne28c7GujkVmZ3\t172.30.1.12\t50607\t8.8.8.8\t53\tudp\t56045\t0.028010\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t73.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:38.921Z","host":{"name":"f6b540842a86"},"log":{"offset":710561,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657521 Key: Timestamp: 2025-12-10 03:46:41.028 Headers: empty

{"@version":"1","event":{"hash":"82816df81ebd1083ee480672618d4fe935dcd21b8c2085a41d5597bb2b308ee1"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338393.158893\tCgFjhx6r7HXnMrGYa\t172.30.1.63\t54508\t172.30.2.171\t5044\ttcp\t-\t2.048092\t0\t0\tS0\tT\tT\t0\tS\t2\t120\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:40.409Z","host":{"name":"f6b540842a86"},"log":{"offset":713925,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657522 Key: Timestamp: 2025-12-10 03:46:41.028 Headers: empty

{"@version":"1","event":{"hash":"a5afeb02c77fc43d476cb311e54750695a9c5014abfc3692f4620336db83c41e"},"ecs":{"version":"1.6.0"},"message":"1765338397.805343\tCXiy1F2Gx31kSgcwW5\t172.30.1.12\t45411\t8.8.8.8\t53\tudp\t56046\t0.015605\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t177.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:39.922Z","host":{"name":"f6b540842a86"},"log":{"offset":710735,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 657523 Key: Timestamp: 2025-12-10 03:46:41.028 Headers: empty

{"@version":"1","event":{"hash":"cff6fe151603c9be829e99c085726b6f79918a77b76f10ef37412a6096f6fae6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338388.453930\tCfbRHj4GVpABNQUsTb\t172.30.1.12\t39464\t8.8.8.8\t53\tudp\tdns\t0.030242\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:46:40.409Z","host":{"name":"f6b540842a86"},"log":{"offset":714050,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network