Kafdrop: Topic: logstash-local-network: Messages

Offset: 640756 Key: Timestamp: 2025-12-09 03:12:45.391 Headers: empty

{"@version":"1","event":{"hash":"e779cd146d9d70ed8b2487021b28de5b2dbd156c87cac86fb9ea723d8c2b73fb"},"ecs":{"version":"1.6.0"},"message":"1765249962.269386\tC0QOTl2qWxvKQhFKw7\t172.30.1.12\t46844\t172.30.1.254\t53\tudp\t34729\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:44.286Z","host":{"name":"f6b540842a86"},"log":{"offset":191788,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640757 Key: Timestamp: 2025-12-09 03:12:45.391 Headers: empty

{"@version":"1","event":{"hash":"b4a01e67a059980b3a4240d1e248607d49689f74dd4eed0069f03f215c9804e9"},"ecs":{"version":"1.6.0"},"message":"1765249963.196499\tCTV2F44Zw6IY9gvdBj\t172.30.1.12\t43889\t172.30.1.254\t53\tudp\t34730\t0.003464\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:44.286Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":191959},"tags":["beats_input_codec_plain_applied"]}

Offset: 640758 Key: Timestamp: 2025-12-09 03:12:45.391 Headers: empty

{"@version":"1","event":{"hash":"2e35d66ee649e75d3aecc48642d35623d0b0e149bb9875d1687d5092cd0fe9f7"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249953.097026\tCekibN2bSf1ZvGk1D9\t172.30.1.12\t52641\t172.30.1.254\t53\tudp\tdns\t0.002621\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:44.351Z","host":{"name":"f6b540842a86"},"log":{"offset":243137,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640759 Key: Timestamp: 2025-12-09 03:12:46.397 Headers: empty

{"@version":"1","event":{"hash":"063075aa21a850983b1fe2960bbaf0c2751a7a62fa16979d606431f170d41ba3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249954.106334\tCyHBur21uYXjaY2qO9\t172.30.1.12\t45377\t172.30.1.254\t53\tudp\tdns\t0.003626\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:45.352Z","host":{"name":"f6b540842a86"},"log":{"offset":243266,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640760 Key: Timestamp: 2025-12-09 03:12:46.397 Headers: empty

{"@version":"1","event":{"hash":"b41d99b2b93fc9c36458936eb84cb4eeaa9b64384cfcd9ef177ecf8dfcbc93ae"},"ecs":{"version":"1.6.0"},"message":"1765249964.206505\tC4O3pU3xuTpChKpL7\t172.30.1.12\t60875\t172.30.1.254\t53\tudp\t34731\t0.003494\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:45.287Z","host":{"name":"f6b540842a86"},"log":{"offset":192137,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640761 Key: Timestamp: 2025-12-09 03:12:47.392 Headers: empty

{"@version":"1","event":{"hash":"a11709cc4965c22f289b6e956b7000858bdcc8196741692636a421a57f5d1830"},"ecs":{"version":"1.6.0"},"message":"1765249965.216642\tCkqam7OoQLPo0JFV8\t172.30.1.12\t55674\t172.30.1.254\t53\tudp\t34732\t0.002522\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:46.288Z","host":{"name":"f6b540842a86"},"log":{"offset":192314,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640762 Key: Timestamp: 2025-12-09 03:12:47.392 Headers: empty

{"@version":"1","event":{"hash":"aa1ddebf004fcb9663f2c9fc4b3eba36ba2dd28181bde2e9c5e1021eb440f25f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249955.116546\tC5FztJeKmXhaZ7Alf\t172.30.1.12\t45179\t172.30.1.254\t53\tudp\tdns\t0.003458\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:46.352Z","host":{"name":"f6b540842a86"},"log":{"offset":243395,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640763 Key: Timestamp: 2025-12-09 03:12:48.392 Headers: empty

{"@version":"1","event":{"hash":"4997deb632687bbe1a4fb1f5c1e28fabc14de3364cc0d9521e3f97e3ec0a04c0"},"ecs":{"version":"1.6.0"},"message":"1765249966.226453\tCYmYNe4Y54x4sB8uM\t172.30.1.12\t36669\t172.30.1.254\t53\tudp\t34733\t0.002785\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:47.288Z","host":{"name":"f6b540842a86"},"log":{"offset":192491,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640764 Key: Timestamp: 2025-12-09 03:12:48.392 Headers: empty

{"@version":"1","event":{"hash":"376e97397e38c3696f2841d2a5188b744ac1b21f94082d2cdbfd35108d604e2d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249956.126431\tCfSnv91FyVbSIxe9Me\t172.30.1.12\t45103\t172.30.1.254\t53\tudp\tdns\t0.003758\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:47.353Z","host":{"name":"f6b540842a86"},"log":{"offset":243523,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640765 Key: Timestamp: 2025-12-09 03:12:48.392 Headers: empty

{"@version":"1","event":{"hash":"d5330a7c51a7fae30efa47b3b9bffc1cd9f2bffb34565177bcd7d25fea63b263"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249956.784982\tCe3LJZ2CXTda2Iebs6\t172.30.1.35\t54130\t8.8.8.8\t53\tudp\tdns\t0.028753\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:47.353Z","host":{"name":"f6b540842a86"},"log":{"offset":243652,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640766 Key: Timestamp: 2025-12-09 03:12:49.394 Headers: empty

{"@version":"1","event":{"hash":"796165908c0bb77d7a0dbbd3a14135b593c59da258ef967eb126237a036441b8"},"ecs":{"version":"1.6.0"},"message":"1765249966.793079\tCJh1tw43gTiIkmc981\t172.30.1.35\t50139\t8.8.8.8\t53\tudp\t11958\t0.029964\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2167.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:48.289Z","host":{"name":"f6b540842a86"},"log":{"offset":192668,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640767 Key: Timestamp: 2025-12-09 03:12:49.394 Headers: empty

{"@version":"1","event":{"hash":"7825cc01da3f20dc799c5edf35e2f81cd6d59b9498b31655208157a32c138f54"},"ecs":{"version":"1.6.0"},"message":"1765249967.236557\tCdpiVr4CNEKvxIleNd\t172.30.1.12\t48664\t172.30.1.254\t53\tudp\t34734\t0.003561\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:48.289Z","host":{"name":"f6b540842a86"},"log":{"offset":192837,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640768 Key: Timestamp: 2025-12-09 03:12:49.394 Headers: empty

{"@version":"1","event":{"hash":"9f589a5d3d84423c69ea59e60438319afff6d5c8e21f02939a2550b34360bc0b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249957.136471\tCiOzAY1gdpPfVrLZLg\t172.30.1.12\t38566\t172.30.1.254\t53\tudp\tdns\t0.003811\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:48.353Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":243778},"tags":["beats_input_codec_plain_applied"]}

Offset: 640769 Key: Timestamp: 2025-12-09 03:12:50.398 Headers: empty

{"@version":"1","event":{"hash":"23b28154925dc9aac98b36ddf0b97d976af0d5e9d757d8df02f95eda103883ff"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249958.146381\tCxYMe916BVNhxHsG89\t172.30.1.12\t56722\t172.30.1.254\t53\tudp\tdns\t0.003855\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:49.353Z","host":{"name":"f6b540842a86"},"log":{"offset":243907,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640770 Key: Timestamp: 2025-12-09 03:12:50.398 Headers: empty

{"@version":"1","event":{"hash":"d73abd4d03e9b3aaa808a9580d1da0e285e2d7fdbe245aa0f42a88af0f64ec9d"},"ecs":{"version":"1.6.0"},"message":"1765249966.753604\tCuywmjOiFEVuJayXd\t172.30.1.35\t50139\t172.30.1.254\t53\tudp\t11958\t0.598734\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2944.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:49.294Z","host":{"name":"f6b540842a86"},"log":{"offset":193015,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640771 Key: Timestamp: 2025-12-09 03:12:50.398 Headers: empty

{"@version":"1","event":{"hash":"820278651195915360afd1319c8af6626d1a4d7039121fa4a2fb36d6d835a9f1"},"ecs":{"version":"1.6.0"},"message":"1765249968.246459\tCdX4Uy4Q2qi8CyaYV1\t172.30.1.12\t37736\t172.30.1.254\t53\tudp\t34735\t0.002671\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:49.294Z","host":{"name":"f6b540842a86"},"log":{"offset":193188,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640772 Key: Timestamp: 2025-12-09 03:12:51.458 Headers: empty

{"@version":"1","event":{"hash":"1895fdc5bfbc7870745b24ef0a0ca3eaef181d587e0ca97d0d8ee51eff9e11f8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249905.677721\tCmi6wApab3hdWOJ4l\t172.30.1.222\t61088\t239.255.255.250\t1900\tudp\t-\t3.019651\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:50.353Z","host":{"name":"f6b540842a86"},"log":{"offset":244036,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640773 Key: Timestamp: 2025-12-09 03:12:51.458 Headers: empty

{"@version":"1","event":{"hash":"7414ab624b2d4cb4edd11bc531ff0ce44c68baed1b6de9bc2a49164d1415cb65"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249959.156401\tCLvdomVIZOnXDIxHi\t172.30.1.12\t56436\t172.30.1.254\t53\tudp\tdns\t0.006074\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:50.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244167,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640774 Key: Timestamp: 2025-12-09 03:12:51.458 Headers: empty

{"@version":"1","event":{"hash":"b0c30f5ceb69e2a7cf8d7f6eadda581d4f60b7a780c73773065fe55341b8b18c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249960.166394\tC8XkLh4fuB8giHeeN8\t172.30.1.12\t47315\t172.30.1.254\t53\tudp\tdns\t0.003122\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:50.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244295,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640775 Key: Timestamp: 2025-12-09 03:12:53.401 Headers: empty

{"@version":"1","event":{"hash":"1861b971774d69d87fb3777ae2b9474db50a37e4422a5e7ba3e15c793b1f7389"},"ecs":{"version":"1.6.0"},"message":"1765249970.266494\tCIkLWfFm5cJO8LBMj\t172.30.1.12\t54316\t172.30.1.254\t53\tudp\t34737\t0.003016\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:52.295Z","host":{"name":"f6b540842a86"},"log":{"offset":193536,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640776 Key: Timestamp: 2025-12-09 03:12:53.401 Headers: empty

{"@version":"1","event":{"hash":"1f1166720bc3ed3f72cff864ffb4566b5b710eb63f4f8c7efe06e34b23c3c837"},"ecs":{"version":"1.6.0"},"message":"1765249969.344224\tCEmjl13bLtDUuvcmi\t172.30.1.12\t60233\t172.30.1.254\t53\tudp\t34736\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:52.295Z","host":{"name":"f6b540842a86"},"log":{"offset":193366,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640777 Key: Timestamp: 2025-12-09 03:12:53.401 Headers: empty

{"@version":"1","event":{"hash":"beae120108153997b847ffd4caeb4e3eec5984a98ca61156aa87dd7ebb609b0f"},"ecs":{"version":"1.6.0"},"message":"1765249971.276791\tCLBtYk1mCqfJQbMy9f\t172.30.1.12\t41303\t172.30.1.254\t53\tudp\t34738\t0.003110\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t150.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:52.295Z","host":{"name":"f6b540842a86"},"log":{"offset":193713,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640778 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"2f1cec4b2ae3c003a555ce5c9912b89fda1991cc996434c8f29c654f78c356ee"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249965.680562\tCRHT8x4KKPRxeidCs\t172.30.1.2\t33128\t172.30.4.139\t1514\ttcp\t-\t3.006684\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244424,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640779 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"272d0bceb0e158edaac4b46c2cac38128eeec637a7ac31b62e7ad7ec7c1dcbbf"},"ecs":{"version":"1.6.0"},"message":"1765249971.741297\tCm8amO1qf0nwLV2dnk\t172.30.1.35\t53476\t172.30.1.254\t53\tudp\t47189\t0.005446\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2940.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.295Z","host":{"name":"f6b540842a86"},"log":{"offset":193891,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640780 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"2b2f590b86529bf724b2779070ca999ee0631494c9d8f29a73588615b46e0494"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249961.176428\tCGOKH12KnzXCJyEAs5\t172.30.1.12\t59483\t172.30.1.254\t53\tudp\tdns\t0.003332\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244548,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640781 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"be3c7ba2b82a3a7a737f443a9ad2ae710a2458412bb4e85c5015900cdc7ed308"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249951.751242\tC2wNRA28BaKQyBqxM2\t172.30.1.35\t61975\t172.30.1.254\t53\tudp\tdns\t2.018285\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244677,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640782 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"d019c7760075202081f2a9057b58eebdfaf3b60f0be7265362975e6508a60184"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249962.186585\tC0QOTl2qWxvKQhFKw7\t172.30.1.12\t46844\t172.30.1.254\t53\tudp\tdns\t0.003050\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244808,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640783 Key: Timestamp: 2025-12-09 03:12:54.400 Headers: empty

{"@version":"1","event":{"hash":"c081c79b09560cdb8a911ddcbe5b9aa064e61e93c1f21aeedcf97fedd4be0c54"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249961.744578\tCJp4Sf2TlJ0fR4LGs3\t172.30.1.35\t53797\t172.30.1.254\t53\tudp\tdns\t0.005184\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:53.354Z","host":{"name":"f6b540842a86"},"log":{"offset":244937,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640784 Key: Timestamp: 2025-12-09 03:12:55.399 Headers: empty

{"@version":"1","event":{"hash":"66ff7bdfecb544d0b189bc8ff49de5921fac735a2f8709161bd47300188c5e05"},"ecs":{"version":"1.6.0"},"message":"1765249973.296553\tCLbnsy4Qf8RUGsH2Ci\t172.30.1.12\t51404\t172.30.1.254\t53\tudp\t34740\t0.003371\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:54.296Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":194235},"tags":["beats_input_codec_plain_applied"]}

Offset: 640785 Key: Timestamp: 2025-12-09 03:12:55.400 Headers: empty

{"@version":"1","event":{"hash":"5ecaf152a567f5fe0341801f476d5518c1e4f967b824cc898b8fec76a7fb6fc2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249963.196499\tCTV2F44Zw6IY9gvdBj\t172.30.1.12\t43889\t172.30.1.254\t53\tudp\tdns\t0.003464\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:54.354Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":245068},"tags":["beats_input_codec_plain_applied"]}

Offset: 640786 Key: Timestamp: 2025-12-09 03:12:55.399 Headers: empty

{"@version":"1","event":{"hash":"3f8ca57ba015f4f519ec34aa354c4b2d481d348e10aed64f38dde4c4ef0a5913"},"ecs":{"version":"1.6.0"},"message":"1765249972.355131\tCFSFxi1ArOrAX1fIz6\t172.30.1.12\t40357\t172.30.1.254\t53\tudp\t34739\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:54.296Z","host":{"name":"f6b540842a86"},"log":{"offset":194065,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640787 Key: Timestamp: 2025-12-09 03:12:56.400 Headers: empty

{"@version":"1","event":{"hash":"be17691557cfd8e6b0e4f2f49037da78305cf67a53cb2d21044f7ce6f754d041"},"ecs":{"version":"1.6.0"},"message":"1765249974.306634\tCRV7n22KxbZhPG6o38\t172.30.1.12\t46449\t172.30.1.254\t53\tudp\t34741\t0.003319\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:55.296Z","host":{"name":"f6b540842a86"},"log":{"offset":194412,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640788 Key: Timestamp: 2025-12-09 03:12:56.400 Headers: empty

{"@version":"1","event":{"hash":"ec4bbb643c0b70c87f1d8b99d481f6bf0251a083fa51d88928b97f170600d6d4"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249964.206505\tC4O3pU3xuTpChKpL7\t172.30.1.12\t60875\t172.30.1.254\t53\tudp\tdns\t0.003494\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:55.355Z","host":{"name":"f6b540842a86"},"log":{"offset":245197,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640789 Key: Timestamp: 2025-12-09 03:12:57.459 Headers: empty

{"@version":"1","event":{"hash":"ed61092a575fdfe1ca6df0b5c558858e48e597ad0927e1a19eefec3067c779b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249965.216642\tCkqam7OoQLPo0JFV8\t172.30.1.12\t55674\t172.30.1.254\t53\tudp\tdns\t0.002522\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:56.355Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":245325},"tags":["beats_input_codec_plain_applied"]}

Offset: 640790 Key: Timestamp: 2025-12-09 03:12:58.459 Headers: empty

{"@version":"1","event":{"hash":"69c5031566a5bee54de91e78acd99846054b3bfe55d85d5fac88d40a1a5a52ce"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249971.158735\tC2uxoK20VhwMEBj8Yb\t172.30.1.2\t40802\t172.30.4.136\t5044\ttcp\t-\t2.990679\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:57.356Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":245453},"tags":["beats_input_codec_plain_applied"]}

Offset: 640791 Key: Timestamp: 2025-12-09 03:12:58.459 Headers: empty

{"@version":"1","event":{"hash":"87f2921e9e402a37e32814eb2bba66265951b620d46eb7d636750cdd64942424"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249966.226453\tCYmYNe4Y54x4sB8uM\t172.30.1.12\t36669\t172.30.1.254\t53\tudp\tdns\t0.002785\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:57.356Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":245578},"tags":["beats_input_codec_plain_applied"]}

Offset: 640792 Key: Timestamp: 2025-12-09 03:12:58.460 Headers: empty

{"@version":"1","event":{"hash":"33f2155412a89f3c35705bd2c796385bea95dd8fd1e2b9b4814f885fb09e0e5a"},"ecs":{"version":"1.6.0"},"message":"1765249976.793310\tC1BoYz1bTqFIXo7kg\t172.30.1.35\t49762\t172.30.1.254\t53\tudp\t32772\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2935.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.297Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":194942},"tags":["beats_input_codec_plain_applied"]}

Offset: 640793 Key: Timestamp: 2025-12-09 03:12:58.460 Headers: empty

{"@version":"1","event":{"hash":"ce9ee9e2d9b79b23a408acf8fcc74270c153aa3676a8a24508cbef097419afbb"},"ecs":{"version":"1.6.0"},"message":"1765249977.350089\tCj7ZIY25BtMIDPBMAb\t172.30.1.12\t45397\t172.30.1.254\t53\tudp\t34744\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.297Z","host":{"name":"f6b540842a86"},"log":{"offset":195108,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640794 Key: Timestamp: 2025-12-09 03:12:58.460 Headers: empty

{"@version":"1","event":{"hash":"c6f09803364cd76b9c5345f6885cf49829b60b0401b787ed7eb696b02e98e83b"},"ecs":{"version":"1.6.0"},"message":"1765249975.316520\tCabRLG7H6Y2wxZx2a\t172.30.1.12\t56475\t172.30.1.254\t53\tudp\t34742\t0.002660\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.297Z","host":{"name":"f6b540842a86"},"log":{"offset":194589,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640795 Key: Timestamp: 2025-12-09 03:12:58.460 Headers: empty

{"@version":"1","event":{"hash":"b2a1bdc872d30e85073ab92e9b2d8434f3cb52141e8861ff6b40b31cf65901c6"},"ecs":{"version":"1.6.0"},"message":"1765249976.326546\tCGykBE2IhJMBPIc0Ei\t172.30.1.12\t51245\t172.30.1.254\t53\tudp\t34743\t0.003675\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.297Z","host":{"name":"f6b540842a86"},"log":{"offset":194765,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640796 Key: Timestamp: 2025-12-09 03:12:59.462 Headers: empty

{"@version":"1","event":{"hash":"b923c06803a3a31538025175dff3ebbbe62a2dc1358452dcc3deba413dd8ed96"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249956.746056\tCEzarJ3Hfp2iND8R99\t172.30.1.35\t54130\t172.30.1.254\t53\tudp\tdns\t2.013512\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.356Z","host":{"name":"f6b540842a86"},"log":{"offset":245706,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640797 Key: Timestamp: 2025-12-09 03:12:59.462 Headers: empty

{"@version":"1","event":{"hash":"1c759a33e762d1d8de8edbb0a92259dbdae00a6cae751c4d653f8a9949711ce3"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249966.793079\tCJh1tw43gTiIkmc981\t172.30.1.35\t50139\t8.8.8.8\t53\tudp\tdns\t0.029964\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.356Z","host":{"name":"f6b540842a86"},"log":{"offset":246096,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640798 Key: Timestamp: 2025-12-09 03:12:59.462 Headers: empty

{"@version":"1","event":{"hash":"87609a3198f335ac1652037596dfe2407696a1a949997a80e28192467be719d8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249966.753604\tCuywmjOiFEVuJayXd\t172.30.1.35\t50139\t172.30.1.254\t53\tudp\tdns\t0.598734\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.356Z","host":{"name":"f6b540842a86"},"log":{"offset":245966,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640799 Key: Timestamp: 2025-12-09 03:12:59.462 Headers: empty

{"@version":"1","event":{"hash":"3684541dc21d93fa4b7317c9c9250611c57928909258ab772b1752fa45966377"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249967.236557\tCdpiVr4CNEKvxIleNd\t172.30.1.12\t48664\t172.30.1.254\t53\tudp\tdns\t0.003561\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:58.356Z","host":{"name":"f6b540842a86"},"log":{"offset":245837,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640800 Key: Timestamp: 2025-12-09 03:13:00.460 Headers: empty

{"@version":"1","event":{"hash":"e8305c95ace082e18369dcd5fa201460fd6c169e2c0c439d7ae35adc125ddb38"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249969.256439\tCEmjl13bLtDUuvcmi\t172.30.1.12\t60233\t172.30.1.254\t53\tudp\tdns\t0.003111\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:00.357Z","host":{"name":"f6b540842a86"},"log":{"offset":246351,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640801 Key: Timestamp: 2025-12-09 03:13:00.461 Headers: empty

{"@version":"1","event":{"hash":"724930a42c25844318df0e0a3e2ff7e305e02b9e604ce843548b7445309c0371"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249919.368450\tCF3PRR3NWxbLK6zFrg\t172.30.1.132\t48710\t216.239.35.12\t123\tudp\tntp\t0.030755\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:00.357Z","host":{"name":"f6b540842a86"},"log":{"offset":246479,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640802 Key: Timestamp: 2025-12-09 03:13:00.460 Headers: empty

{"@version":"1","event":{"hash":"a8070451b8c5f717ea59546b74bc424dd63fd840a9565115fb62ab1f37c7ea22"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249968.246459\tCdX4Uy4Q2qi8CyaYV1\t172.30.1.12\t37736\t172.30.1.254\t53\tudp\tdns\t0.002671\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:12:59.356Z","host":{"name":"f6b540842a86"},"log":{"offset":246222,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640803 Key: Timestamp: 2025-12-09 03:13:02.401 Headers: empty

{"@version":"1","event":{"hash":"95ae2351b124a95767ab742ee4c3008167364340ff9feb620b754b1d744cd2d4"},"ecs":{"version":"1.6.0"},"message":"1765249978.383409\tCFNWK94VVL6eqFIvg\t172.30.1.12\t44294\t172.30.1.254\t53\tudp\t34745\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.297Z","host":{"name":"f6b540842a86"},"log":{"offset":195278,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640804 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"5787b5ccc458be605098be7349845d8ec429e30ad4c575fe3cff7f72c7c53d73"},"ecs":{"version":"1.6.0"},"message":"1765249979.502909\tC6CN5a4sWReliUgvYh\t172.30.1.35\t59770\t8.8.8.8\t53\tudp\t13242\t-\tdns.google\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":195447},"tags":["beats_input_codec_plain_applied"]}

Offset: 640805 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"85bc9e1ae3cd275e656e469afcb30f98a3ce0092cf15181a859dc6085e1e39b3"},"ecs":{"version":"1.6.0"},"message":"1765249979.356788\tC11ar02BnnNUqDmlec\t172.30.1.12\t50301\t172.30.1.254\t53\tudp\t34746\t0.002698\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"offset":195587,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640806 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"7b604a27ebf899a3ebddc324514306bb79c42533cd122af989cf97f4b8771eb7"},"ecs":{"version":"1.6.0"},"message":"1765249979.503150\tCJw9wG4NeGpxmk1eS2\t172.30.1.35\t54928\t8.8.8.8\t53\tudp\t48858\t0.026690\tdns.google\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t8.8.4.4,8.8.8.8\t410.000000,410.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"offset":195764,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640807 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"8c47218a1fafd0a76e826d310cc1bfa18fbd614251949d4aa4c056460480ea38"},"ecs":{"version":"1.6.0"},"message":"1765249979.581072\tC0xls62uB6oTzUcy83\t172.30.1.35\t55417\t8.8.8.8\t53\tudp\t7122\t0.028314\toutlook.office.com\t1\tC_INTERNET\t65\tquery-65\t0\tNOERROR\tF\tF\tT\tT\t0\tsubstrate.office.com,outlook.office365.com,ooc-g2.tm-4.office.com,outlook.ms-acdc.office.com,sin-efz.ms-acdc.office.com,outlook-fs.office.com,outlook-ww-acdc-fs.trafficmanager.net\t55.000000,218.000000,34.000000,37.000000,31.000000,2.000000,161.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"offset":195937,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640808 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"5801fb7ce6ea3a9fac9b535fadb389d799e9141b8d77e99652ff4c8703320470"},"ecs":{"version":"1.6.0"},"message":"1765249979.598306\tCIejYa5Z75YEyGQq2\t172.30.1.35\t51962\t8.8.8.8\t53\tudp\t26041\t0.011038\toutlook.office.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tsubstrate.office.com,outlook.office365.com,ooc-g2.tm-4.office.com,outlook.ms-acdc.office.com,sin-efz.ms-acdc.office.com,outlook-fs.office.com,outlook-ww-acdc-fs.trafficmanager.net,40.104.135.194,40.100.137.242,52.98.123.178,52.98.2.194,52.98.51.162,40.99.65.82,40.99.9.2,40.104.53.2\t55.000000,218.000000,34.000000,37.000000,31.000000,2.000000,161.000000,1.000000,1.000000,1.000000,1.000000,1.000000,1.000000,1.000000,1.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":196338},"tags":["beats_input_codec_plain_applied"]}

Offset: 640809 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"a53804ac6aa6d003404432cb0d3f1bbeedf0bd377442050334da4f0ca9e57995"},"ecs":{"version":"1.6.0"},"message":"1765249980.366576\tCIo9U82lXqnGvOxgta\t172.30.1.12\t55073\t172.30.1.254\t53\tudp\t34747\t0.002943\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.298Z","host":{"name":"f6b540842a86"},"log":{"offset":196906,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640810 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"4876a913f7f024d239b886ab4c17e2826c7b2605999a7c88c2e00a48179ccd89"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249970.266494\tCIkLWfFm5cJO8LBMj\t172.30.1.12\t54316\t172.30.1.254\t53\tudp\tdns\t0.003016\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.357Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":246611},"tags":["beats_input_codec_plain_applied"]}

Offset: 640811 Key: Timestamp: 2025-12-09 03:13:02.402 Headers: empty

{"@version":"1","event":{"hash":"73cc68609f2e01732b949275598ee2c7ba5bbd02ff39b95e6e1b12a8da2ae729"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249917.265515\tCNmuRF3c1Fn1gCuRH9\t172.30.1.98\t50860\t239.255.255.250\t1900\tudp\t-\t3.027977\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:01.357Z","host":{"name":"f6b540842a86"},"log":{"offset":246739,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640812 Key: Timestamp: 2025-12-09 03:13:03.404 Headers: empty

{"@version":"1","event":{"hash":"7cbd08b78a6d23f173432b643af272fac4dacfe449b7d8a9854c679c0180a332"},"ecs":{"version":"1.6.0"},"message":"1765249981.376568\tCt0JAO37DSGm1LkPN1\t172.30.1.12\t38588\t172.30.1.254\t53\tudp\t34748\t0.003349\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:02.298Z","host":{"name":"f6b540842a86"},"log":{"offset":197083,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640813 Key: Timestamp: 2025-12-09 03:13:03.404 Headers: empty

{"@version":"1","event":{"hash":"bedf9aa712a3c8893e0390100439f14261a423ee7915ff7c5e76c8036d841bab"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249971.276791\tCLBtYk1mCqfJQbMy9f\t172.30.1.12\t41303\t172.30.1.254\t53\tudp\tdns\t0.003110\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:02.357Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":246870},"tags":["beats_input_codec_plain_applied"]}

Offset: 640814 Key: Timestamp: 2025-12-09 03:13:04.405 Headers: empty

{"@version":"1","event":{"hash":"90da13e6257aad905de230f7aed4aa351c3f6425658c272d39c8b433c3df723c"},"ecs":{"version":"1.6.0"},"message":"1765249981.743143\tCSVmQt1kLuUf5FJcB1\t172.30.1.35\t49854\t172.30.1.254\t53\tudp\t23209\t0.004419\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2930.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:03.301Z","host":{"name":"f6b540842a86"},"log":{"offset":197260,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640815 Key: Timestamp: 2025-12-09 03:13:04.405 Headers: empty

{"@version":"1","event":{"hash":"6ab3ce5ecb4b9bdb89661c57b92baa627ea2aff8d4237851b63a0f122ec49b46"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249971.741297\tCm8amO1qf0nwLV2dnk\t172.30.1.35\t53476\t172.30.1.254\t53\tudp\tdns\t0.005446\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:03.358Z","host":{"name":"f6b540842a86"},"log":{"offset":247128,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640816 Key: Timestamp: 2025-12-09 03:13:04.405 Headers: empty

{"@version":"1","event":{"hash":"00b20ccda4788c9ecc07b0dbee1ca71ef98cc4e916ad7581f99cca70cad6fbc4"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249972.286549\tCFSFxi1ArOrAX1fIz6\t172.30.1.12\t40357\t172.30.1.254\t53\tudp\tdns\t0.003375\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:03.358Z","host":{"name":"f6b540842a86"},"log":{"offset":246999,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640817 Key: Timestamp: 2025-12-09 03:13:05.405 Headers: empty

{"@version":"1","event":{"hash":"8698fa4d92cd18a8c3f78933d2e1f4375ae2da93de03f8c48f099fb0b36e0478"},"ecs":{"version":"1.6.0"},"message":"1765249983.396665\tCSWdw14AZWdIsZUOD1\t172.30.1.12\t51557\t172.30.1.254\t53\tudp\t34750\t0.003509\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:04.302Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":197610},"tags":["beats_input_codec_plain_applied"]}

Offset: 640818 Key: Timestamp: 2025-12-09 03:13:05.405 Headers: empty

{"@version":"1","event":{"hash":"711dd9b7d46d023246d988088f147863e1aa2eb23ca3ceb62be2c100183f715c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249973.296553\tCLbnsy4Qf8RUGsH2Ci\t172.30.1.12\t51404\t172.30.1.254\t53\tudp\tdns\t0.003371\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:04.358Z","host":{"name":"f6b540842a86"},"log":{"offset":247259,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640819 Key: Timestamp: 2025-12-09 03:13:05.405 Headers: empty

{"@version":"1","event":{"hash":"f7a204cf10745f6ee5ec3f6676156ca969da8548c3c58d4cbf130ee840b17126"},"ecs":{"version":"1.6.0"},"message":"1765249982.386648\tCCyE3a91piOYqtzcl\t172.30.1.12\t49351\t172.30.1.254\t53\tudp\t34749\t0.003276\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:04.302Z","host":{"name":"f6b540842a86"},"log":{"offset":197434,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640820 Key: Timestamp: 2025-12-09 03:13:06.465 Headers: empty

{"@version":"1","event":{"hash":"f3849d18b20097b5adf58f6b4b8858b2c1330b04dc20f3934039ad54a6c2dad2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249978.692060\tCuYuXK3E9vjL2Jbpr\t172.30.1.2\t33132\t172.30.4.139\t1514\ttcp\t-\t2.997422\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:05.359Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":247388},"tags":["beats_input_codec_plain_applied"]}

Offset: 640821 Key: Timestamp: 2025-12-09 03:13:06.465 Headers: empty

{"@version":"1","event":{"hash":"1bf23a2e484aabbc69ddb8bfb2e031b16546b1472f4862278fff8c2ec4ad3a5a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249974.306634\tCRV7n22KxbZhPG6o38\t172.30.1.12\t46449\t172.30.1.254\t53\tudp\tdns\t0.003319\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:05.359Z","host":{"name":"f6b540842a86"},"log":{"offset":247512,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640822 Key: Timestamp: 2025-12-09 03:13:08.406 Headers: empty

{"@version":"1","event":{"hash":"ad36d4bbf0d21e8a7f58f3dce127273b26c50d1846467548b0f0ae24fbcb84ba"},"ecs":{"version":"1.6.0"},"message":"1765249984.406753\tCJtHCj1DUBF9cdp3pi\t172.30.1.12\t46154\t172.30.1.254\t53\tudp\t34751\t0.003378\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:07.302Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":197787},"tags":["beats_input_codec_plain_applied"]}

Offset: 640823 Key: Timestamp: 2025-12-09 03:13:08.406 Headers: empty

{"@version":"1","event":{"hash":"5b74dbb2c1b4cc98e528b778a9fe4099ec35848116496889bdd066b0d7f1cb44"},"ecs":{"version":"1.6.0"},"message":"1765249985.473956\tC6vEvwXYEvFVy7oj6\t172.30.1.12\t56407\t172.30.1.254\t53\tudp\t34752\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:07.303Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":197964},"tags":["beats_input_codec_plain_applied"]}

Offset: 640824 Key: Timestamp: 2025-12-09 03:13:09.406 Headers: empty

{"@version":"1","event":{"hash":"fd9eb7afea21d662914124b2244e166869d7bd5b3d2246c6da51b04efc6f9a29"},"ecs":{"version":"1.6.0"},"message":"1765249986.751821\tCSrihE25j9grmZl0Z1\t172.30.1.35\t60743\t172.30.1.254\t53\tudp\t49457\t0.026408\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t510.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.303Z","host":{"name":"f6b540842a86"},"log":{"offset":198309,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640825 Key: Timestamp: 2025-12-09 03:13:09.406 Headers: empty

{"@version":"1","event":{"hash":"d1092dbbc6e60676c3de4bf25be6b2cff95322afd3cdd187debdba9d017dda10"},"ecs":{"version":"1.6.0"},"message":"1765249986.426769\tCmsxbu9aCkFg6Lrw4\t172.30.1.12\t48473\t172.30.1.254\t53\tudp\t34753\t0.003406\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.303Z","host":{"name":"f6b540842a86"},"log":{"offset":198133,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640826 Key: Timestamp: 2025-12-09 03:13:09.407 Headers: empty

{"@version":"1","event":{"hash":"ebe9cd4ab853b66d70095ea3f73a37a9dbbbb22217e598c1151d5e6e5d583316"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249977.336626\tCj7ZIY25BtMIDPBMAb\t172.30.1.12\t45397\t172.30.1.254\t53\tudp\tdns\t0.004096\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.360Z","host":{"name":"f6b540842a86"},"log":{"offset":248028,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640827 Key: Timestamp: 2025-12-09 03:13:09.407 Headers: empty

{"@version":"1","event":{"hash":"3d78e15544c2d84faf4ac8a924fce9ec4f98bef991f394c1070116846b36a89f"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249975.316520\tCabRLG7H6Y2wxZx2a\t172.30.1.12\t56475\t172.30.1.254\t53\tudp\tdns\t0.002660\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.360Z","host":{"name":"f6b540842a86"},"log":{"offset":247641,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640828 Key: Timestamp: 2025-12-09 03:13:09.407 Headers: empty

{"@version":"1","event":{"hash":"99759c6e86fa6a319dc9bd227e0332526443f1455f6ea447cea8cfe5b9fcd6fa"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249976.326546\tCGykBE2IhJMBPIc0Ei\t172.30.1.12\t51245\t172.30.1.254\t53\tudp\tdns\t0.003675\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.360Z","host":{"name":"f6b540842a86"},"log":{"offset":247769,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640829 Key: Timestamp: 2025-12-09 03:13:09.407 Headers: empty

{"@version":"1","event":{"hash":"03eed7f2694074acaca6cba9e3cac3997ac68d3c76caa87ed6f8a87a9c8bd798"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249976.747913\tC1BoYz1bTqFIXo7kg\t172.30.1.35\t49762\t172.30.1.254\t53\tudp\tdns\t0.004894\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:08.360Z","host":{"name":"f6b540842a86"},"log":{"offset":247898,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640830 Key: Timestamp: 2025-12-09 03:13:10.407 Headers: empty

{"@version":"1","event":{"hash":"f7f9b12facc4a010b028b2088c6051252debde9b20df27bc2d45dd5530ae58be"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249978.346555\tCFNWK94VVL6eqFIvg\t172.30.1.12\t44294\t172.30.1.254\t53\tudp\tdns\t0.002854\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:09.360Z","host":{"name":"f6b540842a86"},"log":{"offset":248157,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640831 Key: Timestamp: 2025-12-09 03:13:10.407 Headers: empty

{"@version":"1","event":{"hash":"0b9e7612098faaf11b1381df550a42877d027a01a4ff09f6ec1e3a1c74773a1d"},"ecs":{"version":"1.6.0"},"message":"1765249987.439827\tCqOjFcDmUQKJ6p97c\t172.30.1.12\t32780\t172.30.1.254\t53\tudp\t34754\t0.000085\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:09.303Z","host":{"name":"f6b540842a86"},"log":{"offset":198482,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640832 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"c00751be4bb5ec796450f4b7ce8d5821eb3a56f9755725fc5a1f47d5a6b4385c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249979.356788\tC11ar02BnnNUqDmlec\t172.30.1.12\t50301\t172.30.1.254\t53\tudp\tdns\t0.002698\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:10.360Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":248285},"tags":["beats_input_codec_plain_applied"]}

Offset: 640833 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"d12f6307278b34d19f9e5943263b6f5f7795bcf5fb4b10f7f13cbce66e8c07d4"},"ecs":{"version":"1.6.0"},"message":"1765249988.447851\tCvCLBx44u72x3UjH1j\t172.30.1.12\t57322\t172.30.1.254\t53\tudp\t34755\t0.001570\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:10.304Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":198658},"tags":["beats_input_codec_plain_applied"]}

Offset: 640834 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"ee3450fa437876d4d55ecc9c55c7bce26fbdb410e2858f44e54c5cd2bb721b87"},"ecs":{"version":"1.6.0"},"message":"1765249990.466675\tCWQnWclRd23tl2gk5\t172.30.1.12\t58114\t172.30.1.254\t53\tudp\t34757\t0.003259\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.304Z","host":{"name":"f6b540842a86"},"log":{"offset":199012,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640835 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"8a105be8c6303b9e8b4da0b5dcbe0edb1baf95a3bb94e16b37d147857f1eb809"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249979.581264\tCIejYa5Z75YEyGQq2\t172.30.1.35\t51962\t8.8.8.8\t53\tudp\tdns\t0.028080\t36\t374\tSF\tT\tF\t0\tDd\t1\t64\t1\t402\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:10.360Z","host":{"name":"f6b540842a86"},"log":{"offset":248414,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640836 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"bb71419beb4d17986c5d9bd4711174f174014babbdac5d83c1b4c0416d6d76ad"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249984.676616\tCa7wMX2pOpWDFehhp\t172.30.1.35\t64149\t172.30.2.17\t7680\ttcp\t-\t0.002751\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:10.360Z","host":{"name":"f6b540842a86"},"log":{"offset":248539,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640837 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"39de8e9ffe2e4d3c86cb4d2641bd202759044b65f9171cd028ae267a2695cb7f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249979.502909\tC6CN5a4sWReliUgvYh\t172.30.1.35\t59770\t8.8.8.8\t53\tudp\tdns\t0.027548\t28\t104\tSF\tT\tF\t0\tDd\t1\t56\t1\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:10.360Z","host":{"name":"f6b540842a86"},"log":{"offset":248672,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640838 Key: Timestamp: 2025-12-09 03:13:11.408 Headers: empty

{"@version":"1","event":{"hash":"8ba100a5d2caa9421aa2995f4d786dff732038072a057986d33b1b98b0eed8e0"},"ecs":{"version":"1.6.0"},"message":"1765249989.456872\tCCTLld4jsGnVjPO9W7\t172.30.1.12\t44124\t172.30.1.254\t53\tudp\t34756\t0.002810\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.304Z","host":{"name":"f6b540842a86"},"log":{"offset":198835,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640839 Key: Timestamp: 2025-12-09 03:13:12.465 Headers: empty

{"@version":"1","event":{"hash":"60f51819843f63a856f7d1faf2e50ef45e709e2c28aec2f213d74c28f89bfb5a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249983.523098\tCKfaRN30iUAvyCn9q3\t10.10.10.1\t52134\t10.10.10.202\t8000\ttcp\t-\t0.947890\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":248922},"tags":["beats_input_codec_plain_applied"]}

Offset: 640840 Key: Timestamp: 2025-12-09 03:13:12.465 Headers: empty

{"@version":"1","event":{"hash":"9ea8eb50c2333f69372c7036ab72f71df5b9101c3ce676c12e7c78c414fd4728"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765249979.581072\tC0xls62uB6oTzUcy83\t172.30.1.35\t55417\t8.8.8.8\t53\tudp\tdns\t0.028314\t36\t304\tSF\tT\tF\t0\tDd\t1\t64\t1\t332\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.361Z","host":{"name":"f6b540842a86"},"log":{"offset":249051,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640841 Key: Timestamp: 2025-12-09 03:13:12.465 Headers: empty

{"@version":"1","event":{"hash":"407dae9e5f2e8d7a486524bc0712d958afe451fc633783cc6afe1aa0ca1ea9e5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765249979.503150\tCJw9wG4NeGpxmk1eS2\t172.30.1.35\t54928\t8.8.8.8\t53\tudp\tdns\t0.026690\t28\t60\tSF\tT\tF\t0\tDd\t1\t56\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.361Z","host":{"name":"f6b540842a86"},"log":{"offset":248798,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640842 Key: Timestamp: 2025-12-09 03:13:12.465 Headers: empty

{"@version":"1","event":{"hash":"46e4db3701e5cd2c05e2360efe53c661870edd16b52252e9fcfdbbd0435ea28b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249980.366576\tCIo9U82lXqnGvOxgta\t172.30.1.12\t55073\t172.30.1.254\t53\tudp\tdns\t0.002943\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:11.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":249177},"tags":["beats_input_codec_plain_applied"]}

Offset: 640843 Key: Timestamp: 2025-12-09 03:13:12.465 Headers: empty

{"@version":"1","event":{"hash":"901b407600cb51fbbc8b31cfb6c87e7a5677635da04a848a644492f89133eb87"},"ecs":{"version":"1.6.0"},"message":"1765249991.501700\tCfCtvjmXUny1vvnW8\t172.30.1.12\t51153\t172.30.1.254\t53\tudp\t34758\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t91.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:12.304Z","host":{"name":"f6b540842a86"},"log":{"offset":199188,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640844 Key: Timestamp: 2025-12-09 03:13:13.467 Headers: empty

{"@version":"1","event":{"hash":"5f211282b2e7a8375459ee09f43efe88df8b7bf5bbeb8445969c17d7e55a1c79"},"ecs":{"version":"1.6.0"},"message":"1765249991.743301\tCapcl84BbkLH7pcqrb\t172.30.1.35\t65393\t172.30.1.254\t53\tudp\t1624\t0.005424\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2920.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:13.305Z","host":{"name":"f6b540842a86"},"log":{"offset":199357,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640845 Key: Timestamp: 2025-12-09 03:13:13.467 Headers: empty

{"@version":"1","event":{"hash":"999fcc85baabab8b8772607c9ef635b34e05ab8966e01974be25ffd9133f77c3"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765249981.376568\tCt0JAO37DSGm1LkPN1\t172.30.1.12\t38588\t172.30.1.254\t53\tudp\tdns\t0.003349\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:13:12.361Z","host":{"name":"f6b540842a86"},"log":{"offset":249306,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640846 Key: Timestamp: 2025-12-09 03:14:56.610 Headers: empty

{"@version":"1","event":{"hash":"eedaf268ec5f1d4934b64cb19d023a95967e91a90c80165922c7ebe4e02c578c"},"ecs":{"version":"1.6.0"},"message":"1765250095.517771\tC5XzRW2DfmPqat8pKg\t172.30.1.12\t51217\t172.30.1.254\t53\tudp\t34861\t0.003283\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:56.374Z","host":{"name":"f6b540842a86"},"log":{"offset":226559,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640847 Key: Timestamp: 2025-12-09 03:14:57.618 Headers: empty

{"@version":"1","event":{"hash":"126ee180e231bdfe9f0df4a4e37b9ea6064f0f8743318682f24fbae2d76ffdb9"},"ecs":{"version":"1.6.0"},"message":"1765250096.744672\tCKDhBf1i8bLbJ9p0R6\t172.30.1.35\t53459\t172.30.1.254\t53\tudp\t41430\t0.006763\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2815.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:57.374Z","host":{"name":"f6b540842a86"},"log":{"offset":226737,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640848 Key: Timestamp: 2025-12-09 03:14:57.618 Headers: empty

{"@version":"1","event":{"hash":"f53ecda16676626c9f9010bb7fe16900c778270ea4e70fe2536d11bb65c63e22"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250085.407686\tCLYkRg3Drg1yTWdF39\t172.30.1.12\t40954\t172.30.1.254\t53\tudp\tdns\t0.003275\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:56.507Z","host":{"name":"f6b540842a86"},"log":{"offset":276388,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640849 Key: Timestamp: 2025-12-09 03:14:57.618 Headers: empty

{"@version":"1","event":{"hash":"675bdb3c10c505da99228b7eb599cd271267dd8838b2f9d81390bf51138d4908"},"ecs":{"version":"1.6.0"},"message":"1765250096.527680\tCOUx8o3pGvh8KQOju8\t172.30.1.12\t44875\t172.30.1.254\t53\tudp\t34862\t0.003310\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t300.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:57.374Z","host":{"name":"f6b540842a86"},"log":{"offset":226911,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640850 Key: Timestamp: 2025-12-09 03:14:58.619 Headers: empty

{"@version":"1","event":{"hash":"a7f410a11ca79c29f55a85597bebfd29c0e3b08dc6788a0075c99d7c9560f3d0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765250086.417737\tCuWQOu4m95Q7m60Tla\t172.30.1.12\t58945\t172.30.1.254\t53\tudp\tdns\t0.003244\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:57.515Z","host":{"name":"f6b540842a86"},"log":{"offset":276648,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640851 Key: Timestamp: 2025-12-09 03:14:58.619 Headers: empty

{"@version":"1","event":{"hash":"48cf5861937504795352152ab77f7fd55d4e435c4613e7a7cf6cc4b1ab9e9af1"},"ecs":{"version":"1.6.0"},"message":"1765250097.538477\tCQjD5h3uADUE1SMk3h\t172.30.1.12\t48905\t172.30.1.254\t53\tudp\t34863\t0.002858\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:58.375Z","host":{"name":"f6b540842a86"},"log":{"offset":227089,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640852 Key: Timestamp: 2025-12-09 03:14:58.619 Headers: empty

{"@version":"1","event":{"hash":"c1e688a8c8e4a5e3fd55c0276fad4495c09a5a4ca657372e3ce10551f8dbcc40"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250086.742452\tCvjVPD4W8RwGmJdEd1\t172.30.1.35\t55518\t172.30.1.254\t53\tudp\tdns\t0.005763\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:57.515Z","host":{"name":"f6b540842a86"},"log":{"offset":276517,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640853 Key: Timestamp: 2025-12-09 03:14:59.620 Headers: empty

{"@version":"1","event":{"hash":"c25338ede7b70a3a775660cba324cbde851a03f29f42ca7d0481ced676ffe096"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765250087.427593\tC2MRb21zXZ1ZlMQEBk\t172.30.1.12\t42183\t172.30.1.254\t53\tudp\tdns\t0.003350\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:58.516Z","host":{"name":"f6b540842a86"},"log":{"offset":276777,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 640854 Key: Timestamp: 2025-12-09 03:14:59.620 Headers: empty

{"@version":"1","event":{"hash":"61fa77437f22992866968c7dd3fc20a4daf11295f98b04934cfc28ed72c7ba77"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765250092.766059\tClvUqG3SRYaewT1XQ6\t172.30.1.222\t64649\t8.8.8.8\t53\ttcp\tdns\t0.086448\t30\t106\tSF\tT\tF\t0\tShADadFf\t6\t282\t5\t318\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:58.516Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":277040},"tags":["beats_input_codec_plain_applied"]}

Offset: 640855 Key: Timestamp: 2025-12-09 03:14:59.620 Headers: empty

{"@version":"1","event":{"hash":"8a34b232d35b2376684ddf243ce52a416ded94ca75aee9519626fbcca1abd7d9"},"ecs":{"version":"1.6.0"},"message":"1765250098.547776\tCHo9Hp1wMftBOmhVxe\t172.30.1.12\t43551\t172.30.1.254\t53\tudp\t34864\t0.003419\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t300.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:14:59.375Z","host":{"name":"f6b540842a86"},"log":{"offset":227267,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network