Kafdrop: Topic: logstash-local-network: Messages

Offset: 642334 Key: Timestamp: 2025-12-10 03:32:18.745 Headers: empty

{"@version":"1","event":{"hash":"080c1c6d1cd3ec2af6b6ca24769bc8b6004d932787e9a5835bdd79bbc30401ad"},"ecs":{"version":"1.6.0"},"message":"1765337536.542089\tCTyXRs2Ce6YSWd1gi1\t172.30.1.35\t64139\t172.30.1.254\t53\tudp\t59180\t0.092783\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2260.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:18.188Z","host":{"name":"f6b540842a86"},"log":{"offset":504091,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642335 Key: Timestamp: 2025-12-10 03:32:18.745 Headers: empty

{"@version":"1","event":{"hash":"8fb624474e95b109a6ea63d767cf3c37d13681a9a220009f1161500b0e027329"},"ecs":{"version":"1.6.0"},"message":"1765337537.305718\tCt0EQs17zjqF1aIoW9\t172.30.1.12\t44912\t8.8.8.8\t53\tudp\t55205\t0.029163\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t81.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:18.188Z","host":{"name":"f6b540842a86"},"log":{"offset":504265,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642336 Key: Timestamp: 2025-12-10 03:32:20.291 Headers: empty

{"@version":"1","event":{"hash":"f34036ec6dc16f7b9f58ce2e3ec95a77489aa2d0fb5d4e0340671fa0c6a3961a"},"ecs":{"version":"1.6.0"},"message":"1765337535.514538\tFkT73U1Zs7ixe79zml\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:19.739Z","host":{"name":"f6b540842a86"},"log":{"offset":29001,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642337 Key: Timestamp: 2025-12-10 03:32:20.291 Headers: empty

{"@version":"1","event":{"hash":"15a990dfd414c5c812687f14ac613a88a215ff2530e7da8cf01a8cbf3f00b362"},"ecs":{"version":"1.6.0"},"message":"1765337538.346421\tCzc06q1wyi1kGjemD1\t172.30.1.12\t51814\t8.8.8.8\t53\tudp\t55206\t0.028303\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t136.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:19.188Z","host":{"name":"f6b540842a86"},"log":{"offset":504439,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642338 Key: Timestamp: 2025-12-10 03:32:21.295 Headers: empty

{"@version":"1","event":{"hash":"0d491da78e91589a4f57839108742d359c7de93273858b9a3483f960012464bf"},"ecs":{"version":"1.6.0"},"message":"1765337539.387500\tCPmaOZ27QIxna5ymyi\t172.30.1.12\t40479\t8.8.8.8\t53\tudp\t55207\t0.026362\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t79.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:20.188Z","host":{"name":"f6b540842a86"},"log":{"offset":504614,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642339 Key: Timestamp: 2025-12-10 03:32:21.295 Headers: empty

{"@version":"1","event":{"hash":"6693e528a6bdaccfd93d3acab37da3dc4fe8b4395d7744cfd3aa4e06ccb69138"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337527.865585\tCqgI6944E5w8jhLCV3\t172.30.1.12\t60157\t8.8.8.8\t53\tudp\tdns\t0.028875\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:20.641Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":503076},"tags":["beats_input_codec_plain_applied"]}

Offset: 642340 Key: Timestamp: 2025-12-10 03:32:21.295 Headers: empty

{"@version":"1","event":{"hash":"d7b42cebfab9ff9d1b5e5223b325aee2aa48b258a508abb89fd95abe0a243e0b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337527.896015\tCx5Xlz2isyGEh1IbK2\t172.30.1.12\t38791\t8.8.8.8\t53\tudp\tdns\t0.027865\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:20.641Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":503200},"tags":["beats_input_codec_plain_applied"]}

Offset: 642341 Key: Timestamp: 2025-12-10 03:32:21.295 Headers: empty

{"@version":"1","event":{"hash":"900cf97952532351ad283dd6ba5b4a5df41facedf3fe8008cb900944f0e9c023"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337528.935466\tCAaqCxB3XBCu6D344\t172.30.1.12\t48399\t8.8.8.8\t53\tudp\tdns\t0.028818\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:20.641Z","host":{"name":"f6b540842a86"},"log":{"offset":503324,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642342 Key: Timestamp: 2025-12-10 03:32:22.745 Headers: empty

{"@version":"1","event":{"hash":"3597b8fc3e1ba1883aa7840a5cbca3af0095e251e6df0afb6eb61d30060dadfb"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337529.976696\tCvQIwI1cejO74bCuXl\t172.30.1.12\t57983\t8.8.8.8\t53\tudp\tdns\t0.027210\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:21.642Z","host":{"name":"f6b540842a86"},"log":{"offset":503447,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642343 Key: Timestamp: 2025-12-10 03:32:22.745 Headers: empty

{"@version":"1","event":{"hash":"a515e13229f41548ef3bce86600d7a8675c2f2456a4473f7b9fca4361b0667c4"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337535.210178\tC5bgq23qhfuKLHvQXf\t202.46.62.108\t25380\t172.30.1.2\t80\ttcp\thttp\t0.175243\t311\t510\tSF\tF\tT\t0\tShADadfF\t8\t735\t7\t882\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:21.642Z","host":{"name":"f6b540842a86"},"log":{"offset":503571,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642344 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"03663baa6fdf38ace3c8442f32bde8b42981abca7e0ae84f7c96ff7036d9fb35"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337480.834007\tC5ebEz4xiPP8g3jzGb\t172.30.1.132\t39333\t216.239.35.12\t123\tudp\tntp\t0.029390\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:22.642Z","host":{"name":"f6b540842a86"},"log":{"offset":503711,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642345 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"e9c9d2c4afbb0a310609e778d884f2e767a9ea6e87310e4a8fd34ade2f124ec8"},"ecs":{"version":"1.6.0"},"message":"1765337540.425569\tCMEBZRLQvwiGWHhLk\t172.30.1.12\t42006\t8.8.8.8\t53\tudp\t55208\t0.027165\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t134.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.194Z","host":{"name":"f6b540842a86"},"log":{"offset":504788,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642346 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"2141879c4613ea188d4ed70fa307f5731dd07a5d6c1065ef8c75e7204de6730a"},"ecs":{"version":"1.6.0"},"message":"1765337541.455702\tCLqGwZ2tCzG8hTCE1c\t172.30.1.12\t37792\t8.8.8.8\t53\tudp\t55209\t0.027691\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t77.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.194Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":504962},"tags":["beats_input_codec_plain_applied"]}

Offset: 642347 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"2c55274819de80f04110157877840cae022c14e2c8d4652ee2f9a80da3705dc2"},"ecs":{"version":"1.6.0"},"message":"1765337541.552596\tC2R15U2lTJnhG1ATX8\t172.30.1.35\t58203\t172.30.1.254\t53\tudp\t62907\t0.004039\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2255.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.194Z","host":{"name":"f6b540842a86"},"log":{"offset":505136,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642348 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"bc657a967d1e806b11c02aec66ce9ae3384098d2e80756cbd4892330d518bff1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337531.015510\tC6aMYO2RWehkdLKxp9\t172.30.1.12\t39857\t8.8.8.8\t53\tudp\tdns\t0.028693\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:22.642Z","host":{"name":"f6b540842a86"},"log":{"offset":503843,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642349 Key: Timestamp: 2025-12-10 03:32:23.746 Headers: empty

{"@version":"1","event":{"hash":"8de8fad2988c535ca36899f09165314aceebd2a88666f3f3c1c8e37e3bb23e10"},"ecs":{"version":"1.6.0"},"message":"1765337542.485566\tCmExgl2MXJ24bVtzF\t172.30.1.12\t57587\t8.8.8.8\t53\tudp\t55210\t0.029375\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t290.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.194Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":505310},"tags":["beats_input_codec_plain_applied"]}

Offset: 642350 Key: Timestamp: 2025-12-10 03:32:24.748 Headers: empty

{"@version":"1","event":{"hash":"e029d3277b30f533dbdd843a62b083da2ec82cbaa6a44ecdaf983c8c51788f0d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337531.544499\tCgteoV2SJayA5FqNfk\t172.30.1.35\t59138\t172.30.1.254\t53\tudp\tdns\t0.004197\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.643Z","host":{"name":"f6b540842a86"},"log":{"offset":503967,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642351 Key: Timestamp: 2025-12-10 03:32:24.748 Headers: empty

{"@version":"1","event":{"hash":"a190138ebc7ff5d03acd667624dd95418092a4feced3d386412a195c0738ef98"},"ecs":{"version":"1.6.0"},"message":"1765337543.543404\tC6hqYP38TgjKfr34Uh\t172.30.1.12\t39530\t8.8.8.8\t53\tudp\t55211\t0.011574\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t75.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:24.194Z","host":{"name":"f6b540842a86"},"log":{"offset":505484,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642352 Key: Timestamp: 2025-12-10 03:32:24.748 Headers: empty

{"@version":"1","event":{"hash":"321ebc3a0f0bf262080f67b110afd3dfb6cc301c20be1e615e0980c4a4acfe12"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337532.055507\tCxzY9H1SWGhDIhdIk\t172.30.1.12\t55243\t8.8.8.8\t53\tudp\tdns\t0.027039\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:23.643Z","host":{"name":"f6b540842a86"},"log":{"offset":504098,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642353 Key: Timestamp: 2025-12-10 03:32:25.746 Headers: empty

{"@version":"1","event":{"hash":"3a4b48103677b8cca3459b5b8a27a1cdd7a48401c6d7e33f3b444455424151f3"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337533.085482\tCQeUD74hsHKM3iYfH8\t172.30.1.12\t36519\t8.8.8.8\t53\tudp\tdns\t0.028310\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:24.643Z","host":{"name":"f6b540842a86"},"log":{"offset":504375,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642354 Key: Timestamp: 2025-12-10 03:32:25.746 Headers: empty

{"@version":"1","event":{"hash":"c2ea2cb23b8ab7bce6a0f03a637a81691d3eb35c6afd6c7304ca5ba03b4d8a71"},"ecs":{"version":"1.6.0"},"message":"1765337544.565643\tCokcLV2PeaDKdLp6T4\t172.30.1.12\t37354\t8.8.8.8\t53\tudp\t55212\t0.027010\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t88.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:25.195Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":505658},"tags":["beats_input_codec_plain_applied"]}

Offset: 642355 Key: Timestamp: 2025-12-10 03:32:25.746 Headers: empty

{"@version":"1","event":{"hash":"8ad5bd0db8680b9659bcd44f0b9331d1f9e8f0c44f55d18051d071114b1da02d"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337535.423877\tCJrb4WY0WkwpG5BPl\t202.46.62.117\t5379\t172.30.1.2\t443\ttcp\tssl\t3.006370\t1082\t19037\tRSTR\tF\tT\t194\tShADadGfttRr\t22\t2354\t36\t45113\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:24.643Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":504221},"tags":["beats_input_codec_plain_applied"]}

Offset: 642356 Key: Timestamp: 2025-12-10 03:32:26.747 Headers: empty

{"@version":"1","event":{"hash":"8a2a73c71b3e11ab8ba59396facb1bdc6a04e0e8f77f356706a1579a0fbe1187"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337533.742618\tCxp8k91Eee4wXXibW3\t172.30.1.35\t59245\t172.30.1.254\t53\tudp\tdns\t0.003188\t29\t147\tSF\tT\tT\t0\tDd\t1\t57\t1\t175\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:25.644Z","host":{"name":"f6b540842a86"},"log":{"offset":504499,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642357 Key: Timestamp: 2025-12-10 03:32:26.747 Headers: empty

{"@version":"1","event":{"hash":"b70cec0e0ffb8af1ac4489369f56d5ebf3003e4c5d933cb49554a7ade4d94b85"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337534.125557\tCda6uS1tydlWXWIOm5\t172.30.1.12\t60219\t8.8.8.8\t53\tudp\tdns\t0.092280\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:25.644Z","host":{"name":"f6b540842a86"},"log":{"offset":504630,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642358 Key: Timestamp: 2025-12-10 03:32:26.747 Headers: empty

{"@version":"1","event":{"hash":"85fe21688773d0df2303b8417f287bbaac3d56948a756931c4c71e74b3bd9a7d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337533.779916\tC8hqA33hioind3Ou47\t172.30.1.35\t64055\t172.30.1.254\t53\tudp\tdns\t0.002857\t43\t169\tSF\tT\tT\t0\tDd\t1\t71\t1\t197\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:25.644Z","host":{"name":"f6b540842a86"},"log":{"offset":504754,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642359 Key: Timestamp: 2025-12-10 03:32:27.748 Headers: empty

{"@version":"1","event":{"hash":"ae9a3f622467ab4d906f38ce2bde2d2ee680f8bd61f1846790ab7b27d08276eb"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337540.570068\tCjvkwx3M5Ujvle8DT7\t172.30.1.2\t52258\t172.30.4.139\t1514\ttcp\t-\t3.000764\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:26.644Z","host":{"name":"f6b540842a86"},"log":{"offset":505009,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642360 Key: Timestamp: 2025-12-10 03:32:27.748 Headers: empty

{"@version":"1","event":{"hash":"adc2248616a45d755727c9197f6d301ab6820f2f9db8df8383b0b1e333f226db"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337535.225982\tC1RbWl1tCl8OihtOl2\t172.30.1.12\t60920\t8.8.8.8\t53\tudp\tdns\t0.027823\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:26.644Z","host":{"name":"f6b540842a86"},"log":{"offset":504885,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642361 Key: Timestamp: 2025-12-10 03:32:28.748 Headers: empty

{"@version":"1","event":{"hash":"29543f489e92b2383fab778988ddc0eb02d5aee3fd097f7c45c3018194cc2569"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337536.542089\tCTyXRs2Ce6YSWd1gi1\t172.30.1.35\t64139\t172.30.1.254\t53\tudp\tdns\t0.086484\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:27.645Z","host":{"name":"f6b540842a86"},"log":{"offset":505384,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642362 Key: Timestamp: 2025-12-10 03:32:28.749 Headers: empty

{"@version":"1","event":{"hash":"7b9a4a95716dd84dffb07a492285bc219c5b1c1251a167cb017c839ef8825fd9"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765333914.073365\tCLLyMS3S6SYWAl5EJc\t202.46.62.52\t22373\t172.30.1.2\t80\ttcp\t-\t31.603248\t0\t0\tS1\tF\tT\t0\tSh\t2\t120\t7\t420\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:27.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":505134},"tags":["beats_input_codec_plain_applied"]}

Offset: 642363 Key: Timestamp: 2025-12-10 03:32:28.748 Headers: empty

{"@version":"1","event":{"hash":"9ad74ab79bb19c53d4b5b62f8c0dd0dd4fdddad9df11b0b7dc62e3f1f0297f57"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337536.265569\tCxgIiFkFDaPCB3nsg\t172.30.1.12\t60997\t8.8.8.8\t53\tudp\tdns\t0.029187\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:27.645Z","host":{"name":"f6b540842a86"},"log":{"offset":505261,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642364 Key: Timestamp: 2025-12-10 03:32:28.749 Headers: empty

{"@version":"1","event":{"hash":"9e68c32b07b614fea19e33e052d24148cfd82611da3a4fdfc7b74936ce277c00"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337536.581032\tC5O8squglYJBcqrC8\t172.30.1.35\t64139\t8.8.8.8\t53\tudp\tdns\t0.029334\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:27.645Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":505515},"tags":["beats_input_codec_plain_applied"]}

Offset: 642365 Key: Timestamp: 2025-12-10 03:32:28.749 Headers: empty

{"@version":"1","event":{"hash":"015349653855e4000d7277e3f85e2d61d20d26f6d25e9b8f98fddf8df5f97674"},"ecs":{"version":"1.6.0"},"message":"1765337545.676729\tCh8vnF4ypr5n0Vczbi\t172.30.1.12\t38909\t8.8.8.8\t53\tudp\t55213\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t73.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:28.196Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":505832},"tags":["beats_input_codec_plain_applied"]}

Offset: 642366 Key: Timestamp: 2025-12-10 03:32:28.749 Headers: empty

{"@version":"1","event":{"hash":"f7d0c09df2cde2514ae69ebee4d6d97ad1a02a016724ed4a43301da21a36159a"},"ecs":{"version":"1.6.0"},"message":"1765337546.625691\tCdrbyT2KwXBbmHX0Ld\t172.30.1.12\t55863\t8.8.8.8\t53\tudp\t55214\t0.026981\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t128.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:28.196Z","host":{"name":"f6b540842a86"},"log":{"offset":505999,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642367 Key: Timestamp: 2025-12-10 03:32:28.749 Headers: empty

{"@version":"1","event":{"hash":"009828530edfbaca2354fd4ae39f776f4de99209a5c489e30e29274c81318e26"},"ecs":{"version":"1.6.0"},"message":"1765337546.635086\tCv4LK93Roy7nlnPMBi\t172.30.1.35\t49772\t172.30.1.254\t53\tudp\t43059\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2920.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:28.196Z","host":{"name":"f6b540842a86"},"log":{"offset":506174,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642368 Key: Timestamp: 2025-12-10 03:32:30.300 Headers: empty

{"@version":"1","event":{"hash":"861a9afe06f0611485ac9d3900cdac7f3a7cdf122f1712727f048e3fc70c83f3"},"ecs":{"version":"1.6.0"},"message":"1765337535.505943\tCJrb4WY0WkwpG5BPl\t202.46.62.117\t5379\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tF\tFkT73U1Zs7ixe79zml,Ff3sc03hXDVk0Auomj\t(empty)\t-\t-\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:29.779Z","host":{"name":"f6b540842a86"},"log":{"offset":34857,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642369 Key: Timestamp: 2025-12-10 03:32:30.300 Headers: empty

{"@version":"1","event":{"hash":"711a63f7571c4dd69e5420ca6ce8831c420c87104f79c5ff70ea3b4a89424b5a"},"ecs":{"version":"1.6.0"},"message":"1765337547.655728\tCA7if04gDrMM7iBTd7\t172.30.1.12\t47838\t8.8.8.8\t53\tudp\t55215\t0.028156\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t71.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:29.196Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":506341},"tags":["beats_input_codec_plain_applied"]}

Offset: 642370 Key: Timestamp: 2025-12-10 03:32:31.304 Headers: empty

{"@version":"1","event":{"hash":"2f37ea764d8ef03080f8710a8e54f72ff280d3cd93483d1efe365c440dc74b2c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337538.346421\tCzc06q1wyi1kGjemD1\t172.30.1.12\t51814\t8.8.8.8\t53\tudp\tdns\t0.028303\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:30.646Z","host":{"name":"f6b540842a86"},"log":{"offset":505764,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642371 Key: Timestamp: 2025-12-10 03:32:31.304 Headers: empty

{"@version":"1","event":{"hash":"e48c23d0eeb16079b21777a3c90abd599365d7f5f475621f5400c54417ecb8fb"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337539.387500\tCPmaOZ27QIxna5ymyi\t172.30.1.12\t40479\t8.8.8.8\t53\tudp\tdns\t0.026362\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:30.646Z","host":{"name":"f6b540842a86"},"log":{"offset":505888,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642372 Key: Timestamp: 2025-12-10 03:32:31.304 Headers: empty

{"@version":"1","event":{"hash":"3c8a289dbf4f93092c2ff7a66f41da7589734b57af308fb8a642d682388a5dd2"},"ecs":{"version":"1.6.0"},"message":"1765337548.765896\tC2ErPm3oi2hVrLpSqi\t172.30.1.12\t36998\t8.8.8.8\t53\tudp\t55216\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t70.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:30.197Z","host":{"name":"f6b540842a86"},"log":{"offset":506515,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642373 Key: Timestamp: 2025-12-10 03:32:31.304 Headers: empty

{"@version":"1","event":{"hash":"b2ea4bdc62f8e7c6eccc1e6f00541f4d7c4fe19264a42db76016724beac0cc3e"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337537.305718\tCt0EQs17zjqF1aIoW9\t172.30.1.12\t44912\t8.8.8.8\t53\tudp\tdns\t0.029163\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:30.646Z","host":{"name":"f6b540842a86"},"log":{"offset":505640,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642374 Key: Timestamp: 2025-12-10 03:32:32.304 Headers: empty

{"@version":"1","event":{"hash":"cf6f1d42cea751f8cd3ca5ff4c41b15d1bc5a66c1468e38d93bbe3c9100934a5"},"ecs":{"version":"1.6.0"},"message":"1765337549.735669\tCznyR02YZ2g9feBYL2\t172.30.1.12\t37775\t8.8.8.8\t53\tudp\t55217\t0.095524\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t69.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:31.197Z","host":{"name":"f6b540842a86"},"log":{"offset":506682,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642375 Key: Timestamp: 2025-12-10 03:32:32.304 Headers: empty

{"@version":"1","event":{"hash":"b056e70572e92b9734806370ad2362d05f96f587dea78e859deb5e21a0280ba7"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337545.037536\tCxkpR220EARNBg8pe1\t172.30.1.35\t52172\t172.30.2.17\t7680\ttcp\t-\t0.002778\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:31.646Z","host":{"name":"f6b540842a86"},"log":{"offset":506012,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642376 Key: Timestamp: 2025-12-10 03:32:32.304 Headers: empty

{"@version":"1","event":{"hash":"506dda90fe61ef86765e3c624702a106123f48b80a89b1743c1860e445516ca0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337545.590736\tCnDy2M3VjtwQKFksNi\t172.30.1.2\t59932\t172.30.4.136\t5044\ttcp\t-\t3.004604\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:31.646Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":506146},"tags":["beats_input_codec_plain_applied"]}

Offset: 642377 Key: Timestamp: 2025-12-10 03:32:33.305 Headers: empty

{"@version":"1","event":{"hash":"141bc82645f1052b6567402d4a06fb251f73c3ea8409a691d3577a9541e93562"},"ecs":{"version":"1.6.0"},"message":"1765337550.775850\tCv01ts3b1u2R2CZfZb\t172.30.1.12\t37761\t8.8.8.8\t53\tudp\t55218\t0.028834\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t124.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:32.201Z","host":{"name":"f6b540842a86"},"log":{"offset":506856,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642378 Key: Timestamp: 2025-12-10 03:32:33.305 Headers: empty

{"@version":"1","event":{"hash":"2e9dbda64e9ac1c183882c4e62822e57adccf524d549ca54b6686382474c4d72"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337541.455702\tCLqGwZ2tCzG8hTCE1c\t172.30.1.12\t37792\t8.8.8.8\t53\tudp\tdns\t0.027691\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:32.646Z","host":{"name":"f6b540842a86"},"log":{"offset":506528,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642379 Key: Timestamp: 2025-12-10 03:32:33.305 Headers: empty

{"@version":"1","event":{"hash":"3b73d093386feb6a285ade009a76a3a9557ff1b03c57b01a7d8fcb2bcdd9d69d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337541.552596\tC2R15U2lTJnhG1ATX8\t172.30.1.35\t58203\t172.30.1.254\t53\tudp\tdns\t0.004039\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:32.646Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":506652},"tags":["beats_input_codec_plain_applied"]}

Offset: 642380 Key: Timestamp: 2025-12-10 03:32:33.305 Headers: empty

{"@version":"1","event":{"hash":"33ef982732d2e63e7b122725b3543a4ceeb11196834681ef282750888572618f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337545.441556\tCc3f9k2RDV1r45Rt0f\t172.30.2.16\t52623\t172.30.1.35\t7680\ttcp\t-\t0.002245\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:32.646Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":506394},"tags":["beats_input_codec_plain_applied"]}

Offset: 642381 Key: Timestamp: 2025-12-10 03:32:33.305 Headers: empty

{"@version":"1","event":{"hash":"e2f7270296e761ddec39837c29ecef8b1b3dde66c68c7497c35c9a017638f77d"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337540.425569\tCMEBZRLQvwiGWHhLk\t172.30.1.12\t42006\t8.8.8.8\t53\tudp\tdns\t0.027165\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:32.646Z","host":{"name":"f6b540842a86"},"log":{"offset":506271,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642382 Key: Timestamp: 2025-12-10 03:32:34.311 Headers: empty

{"@version":"1","event":{"hash":"5521e5ce66d3209a2eb1104a3d8a60eab72ed3ec37cc8664086d174e2f006859"},"ecs":{"version":"1.6.0"},"message":"1765337551.551021\tC3KGoG7KBqNPqIOQ8\t172.30.1.35\t53428\t172.30.1.254\t53\tudp\t8580\t0.004651\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2245.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:33.207Z","host":{"name":"f6b540842a86"},"log":{"offset":507031,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642383 Key: Timestamp: 2025-12-10 03:32:34.311 Headers: empty

{"@version":"1","event":{"hash":"6e1500a1596b7c92a472de35d4bec41f09f6cb779a402d2a27f927ee3d12b4d9"},"ecs":{"version":"1.6.0"},"message":"1765337551.844346\tClupME4vtG2Rv2B10l\t172.30.1.12\t58654\t8.8.8.8\t53\tudp\t55219\t0.001053\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t67.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:33.207Z","host":{"name":"f6b540842a86"},"log":{"offset":507203,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642384 Key: Timestamp: 2025-12-10 03:32:34.311 Headers: empty

{"@version":"1","event":{"hash":"b992206588df8d7a730d1b7ef056f2685563e98bcc5b0b771daaaaad5002e1f9"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337542.485566\tCmExgl2MXJ24bVtzF\t172.30.1.12\t57587\t8.8.8.8\t53\tudp\tdns\t0.029375\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:33.647Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":506783},"tags":["beats_input_codec_plain_applied"]}

Offset: 642385 Key: Timestamp: 2025-12-10 03:32:35.310 Headers: empty

{"@version":"1","event":{"hash":"5e4e2272fca3c9a59a06723fca5b64d1f94f6801b714510a1b1d5002421e5767"},"ecs":{"version":"1.6.0"},"message":"1765337552.856136\tCnehtA4A9OFovqX3H8\t172.30.1.12\t39036\t8.8.8.8\t53\tudp\t55220\t0.062489\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t66.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:34.207Z","host":{"name":"f6b540842a86"},"log":{"offset":507377,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642386 Key: Timestamp: 2025-12-10 03:32:35.310 Headers: empty

{"@version":"1","event":{"hash":"423fa3cc44e2528059b4670cea12e92ecdbac702cf4f21b39c6c9d93ef039c08"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337543.525616\tC6hqYP38TgjKfr34Uh\t172.30.1.12\t39530\t8.8.8.8\t53\tudp\tdns\t0.029362\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:34.647Z","host":{"name":"f6b540842a86"},"log":{"offset":506906,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642387 Key: Timestamp: 2025-12-10 03:32:35.310 Headers: empty

{"@version":"1","event":{"hash":"bde3ccf698738f719ed9344d313fadc424e76007a2251fba7ddcd7b30e7b5f19"},"ecs":{"version":"1.6.0"},"message":"1765337552.897202\tC2Qx2wIdZX5UbXkJg\t172.30.1.12\t49424\t8.8.8.8\t53\tudp\t55221\t0.017632\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t122.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:34.207Z","host":{"name":"f6b540842a86"},"log":{"offset":507551,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642388 Key: Timestamp: 2025-12-10 03:32:36.312 Headers: empty

{"@version":"1","event":{"hash":"abb7640193dec63a63e14de3ae5354e3fbb54f751f0c4c66f30f264ecc5c2396"},"ecs":{"version":"1.6.0"},"message":"1765337553.925734\tCw1eDtCXz9TSnPsQ7\t172.30.1.12\t59311\t8.8.8.8\t53\tudp\t55222\t0.029790\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t65.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:35.208Z","host":{"name":"f6b540842a86"},"log":{"offset":507725,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642389 Key: Timestamp: 2025-12-10 03:32:36.312 Headers: empty

{"@version":"1","event":{"hash":"1db09c6c9139c03b24f2b6ae0a05742d0bc3a7c406b326163af40520bb578ea7"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337544.565643\tCokcLV2PeaDKdLp6T4\t172.30.1.12\t37354\t8.8.8.8\t53\tudp\tdns\t0.027010\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:35.648Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":507030},"tags":["beats_input_codec_plain_applied"]}

Offset: 642390 Key: Timestamp: 2025-12-10 03:32:37.315 Headers: empty

{"@version":"1","event":{"hash":"9e73e76969691c4d9b83804b4b99e86d7fe219d3eb133e3a02fac9d16f7feb89"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337545.595713\tCh8vnF4ypr5n0Vczbi\t172.30.1.12\t38909\t8.8.8.8\t53\tudp\tdns\t0.027432\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:36.648Z","host":{"name":"f6b540842a86"},"log":{"offset":507154,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642391 Key: Timestamp: 2025-12-10 03:32:37.315 Headers: empty

{"@version":"1","event":{"hash":"f0d88def86adbe642bf80f150bfb9c616018ed5d92eb0dd0ca586f9805756d35"},"ecs":{"version":"1.6.0"},"message":"1765337554.965789\tCUrMnx31Yn2wWpJN2c\t172.30.1.12\t51939\t8.8.8.8\t53\tudp\t55223\t0.027747\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t64.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:36.210Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":507898},"tags":["beats_input_codec_plain_applied"]}

Offset: 642392 Key: Timestamp: 2025-12-10 03:32:38.313 Headers: empty

{"@version":"1","event":{"hash":"ce8bae4d9ddd4901f2487d3cbb4db39fa0302fb2d2d627678f662095a467e8ff"},"ecs":{"version":"1.6.0"},"message":"1765337556.606983\tCieJdR3mjy47AJEc3j\t172.30.1.35\t59383\t8.8.8.8\t53\tudp\t40487\t0.009884\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1305.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:37.210Z","host":{"name":"f6b540842a86"},"log":{"offset":508072,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642393 Key: Timestamp: 2025-12-10 03:32:38.314 Headers: empty

{"@version":"1","event":{"hash":"34e77d9d12ee386651692a99f8280fbbecbeba74fc7d0edca9b92be5e74e9b5a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337546.625691\tCdrbyT2KwXBbmHX0Ld\t172.30.1.12\t55863\t8.8.8.8\t53\tudp\tdns\t0.026981\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:37.648Z","host":{"name":"f6b540842a86"},"log":{"offset":507409,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642394 Key: Timestamp: 2025-12-10 03:32:38.314 Headers: empty

{"@version":"1","event":{"hash":"2b73dc6c444436fc4ff268e8c97aa3606b9716812839b055833ab064a775ea7d"},"ecs":{"version":"1.6.0"},"message":"1765337557.025740\tCPPlkb14z8E4JeaXii\t172.30.1.12\t33035\t8.8.8.8\t53\tudp\t55225\t0.029293\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t117.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:38.210Z","host":{"name":"f6b540842a86"},"log":{"offset":508416,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642395 Key: Timestamp: 2025-12-10 03:32:38.313 Headers: empty

{"@version":"1","event":{"hash":"f768d30a65acc65943cadf7a34b4dfffc8f1b58a3c1174362980e993e36077ab"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337546.554045\tCv4LK93Roy7nlnPMBi\t172.30.1.35\t49772\t172.30.1.254\t53\tudp\tdns\t0.025110\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:37.648Z","host":{"name":"f6b540842a86"},"log":{"offset":507278,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642396 Key: Timestamp: 2025-12-10 03:32:38.314 Headers: empty

{"@version":"1","event":{"hash":"c971d562751d77b105bafdf7de8492fac26d540a0eecbe4630a4d55187cc2245"},"ecs":{"version":"1.6.0"},"message":"1765337555.995719\tC0QkrM1JZOJYeDOT1c\t172.30.1.12\t37211\t8.8.8.8\t53\tudp\t55224\t0.026820\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t118.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:37.210Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":508241},"tags":["beats_input_codec_plain_applied"]}

Offset: 642397 Key: Timestamp: 2025-12-10 03:32:41.753 Headers: empty

{"@version":"1","event":{"hash":"5ab41aaad1908fb5f6b304a9cb6c81afea553df101cc268294e2d68d96f6fc5e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337548.695768\tC2ErPm3oi2hVrLpSqi\t172.30.1.12\t36998\t8.8.8.8\t53\tudp\tdns\t0.029375\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:40.649Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":507781},"tags":["beats_input_codec_plain_applied"]}

Offset: 642398 Key: Timestamp: 2025-12-10 03:32:41.753 Headers: empty

{"@version":"1","event":{"hash":"f27e512fc8e755591acdb3371e138916915910210959ed50381a1371d1ffc547"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337547.655728\tCA7if04gDrMM7iBTd7\t172.30.1.12\t47838\t8.8.8.8\t53\tudp\tdns\t0.028156\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:40.649Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":507533},"tags":["beats_input_codec_plain_applied"]}

Offset: 642399 Key: Timestamp: 2025-12-10 03:32:41.753 Headers: empty

{"@version":"1","event":{"hash":"e13de0a08db660a5e6bfb8ed4b189c8f5e4183c731533f58cc81b1074c4183c5"},"ecs":{"version":"1.6.0"},"message":"1765337556.551522\tCwiD1n1mjnOuyfusj\t172.30.1.35\t59383\t172.30.1.254\t53\tudp\t40487\t2.017531\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2264.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.211Z","host":{"name":"f6b540842a86"},"log":{"offset":508591,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642400 Key: Timestamp: 2025-12-10 03:32:41.753 Headers: empty

{"@version":"1","event":{"hash":"192ae9d164586cfbe029de857876cf17f0755fe65fcf8dc6f3dc8841c61763a5"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337553.571188\tC2MzZK3q0JMP5KSLa\t172.30.1.2\t52262\t172.30.4.139\t1514\ttcp\t-\t2.998974\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:40.649Z","host":{"name":"f6b540842a86"},"log":{"offset":507657,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642401 Key: Timestamp: 2025-12-10 03:32:41.754 Headers: empty

{"@version":"1","event":{"hash":"93f0b161a0c26664cbf3b1a164475001c5b592ccbd164f815db5c56395d0343a"},"ecs":{"version":"1.6.0"},"message":"1765337558.065800\tCGvhFxaFVwFh7SbB7\t172.30.1.12\t53767\t8.8.8.8\t53\tudp\t55226\t0.027433\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t60.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.211Z","host":{"name":"f6b540842a86"},"log":{"offset":508764,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642402 Key: Timestamp: 2025-12-10 03:32:41.754 Headers: empty

{"@version":"1","event":{"hash":"f071f73c0e68dce2e95d558a8f306c4a23bcd6205ed792d957cb5253e109a7f7"},"ecs":{"version":"1.6.0"},"message":"1765337559.095744\tCYpoGZMci4le9vEma\t172.30.1.12\t36064\t8.8.8.8\t53\tudp\t55227\t0.027352\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t115.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.211Z","host":{"name":"f6b540842a86"},"log":{"offset":508937,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642403 Key: Timestamp: 2025-12-10 03:32:41.754 Headers: empty

{"@version":"1","event":{"hash":"5b8045c3a01e6114b7229d7d223e85b4aa15bd6af4f33f30e7999619d536b9f2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337499.397753\tCVllMf3TKwNcLVlO1b\t172.30.1.132\t3\t8.8.8.8\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tF\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.649Z","host":{"name":"f6b540842a86"},"log":{"offset":507905,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642404 Key: Timestamp: 2025-12-10 03:32:41.754 Headers: empty

{"@version":"1","event":{"hash":"017b407f800752412089347f1dbe22b23d53d93688ccd531e252950648b67211"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337549.735669\tCznyR02YZ2g9feBYL2\t172.30.1.12\t37775\t8.8.8.8\t53\tudp\tdns\t0.029811\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.649Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":508014},"tags":["beats_input_codec_plain_applied"]}

Offset: 642405 Key: Timestamp: 2025-12-10 03:32:41.754 Headers: empty

{"@version":"1","event":{"hash":"0809f5d391a769a7f6d2f3c7d56dbd0a79f48d7ba626d83709f9480d0460752f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337550.775850\tCv01ts3b1u2R2CZfZb\t172.30.1.12\t37761\t8.8.8.8\t53\tudp\tdns\t0.028834\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:41.650Z","host":{"name":"f6b540842a86"},"log":{"offset":508138,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642406 Key: Timestamp: 2025-12-10 03:32:43.318 Headers: empty

{"@version":"1","event":{"hash":"07dd0066aabf4e76dfccb1227f5c0dcad9335b41471a7bddac396b565ee0921e"},"ecs":{"version":"1.6.0"},"message":"1765337561.155869\tCmkRbq1zTVscLR47sc\t172.30.1.12\t32860\t8.8.8.8\t53\tudp\t55229\t0.029478\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t57.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:42.211Z","host":{"name":"f6b540842a86"},"log":{"offset":509284,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642407 Key: Timestamp: 2025-12-10 03:32:43.318 Headers: empty

{"@version":"1","event":{"hash":"a56cd6fd3552d16a7481000af83dac0f785fd5f31ba9b2e9cc355b9f82d98854"},"ecs":{"version":"1.6.0"},"message":"1765337560.125775\tChyMEJ2wfGNgZFvpb\t172.30.1.12\t53999\t8.8.8.8\t53\tudp\t55228\t0.026872\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t58.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:42.211Z","host":{"name":"f6b540842a86"},"log":{"offset":509111,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642408 Key: Timestamp: 2025-12-10 03:32:43.318 Headers: empty

{"@version":"1","event":{"hash":"393878f315d70bd974203519804e58eb68a5fc21d3f51979d9852b7194107bfc"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337551.551021\tC3KGoG7KBqNPqIOQ8\t172.30.1.35\t53428\t172.30.1.254\t53\tudp\tdns\t0.004651\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:42.650Z","host":{"name":"f6b540842a86"},"log":{"offset":508262,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642409 Key: Timestamp: 2025-12-10 03:32:44.315 Headers: empty

{"@version":"1","event":{"hash":"61d766b19a994e94de511e846619773a8cd83406b06d96e4dfd46ef403210d8f"},"ecs":{"version":"1.6.0"},"message":"1765337561.583887\tCWDdVb2adsMyKHKdIe\t172.30.1.35\t62139\t8.8.8.8\t53\tudp\t22483\t0.028077\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t783.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:43.212Z","host":{"name":"f6b540842a86"},"log":{"offset":509458,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642410 Key: Timestamp: 2025-12-10 03:32:44.315 Headers: empty

{"@version":"1","event":{"hash":"b60d8d2fd7cc27776b8bf0dffab577ec4923373b9cca7034788c759328dd0936"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337551.815822\tClupME4vtG2Rv2B10l\t172.30.1.12\t58654\t8.8.8.8\t53\tudp\tdns\t0.029577\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:43.650Z","host":{"name":"f6b540842a86"},"log":{"offset":508392,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642411 Key: Timestamp: 2025-12-10 03:32:44.315 Headers: empty

{"@version":"1","event":{"hash":"f030210807ece0dd9c5b4c4dcd1403f75f4ec2b63020e0d4adf9c9c0698f3d15"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337552.856136\tCnehtA4A9OFovqX3H8\t172.30.1.12\t39036\t8.8.8.8\t53\tudp\tdns\t0.030431\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:43.650Z","host":{"name":"f6b540842a86"},"log":{"offset":508516,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642412 Key: Timestamp: 2025-12-10 03:32:44.315 Headers: empty

{"@version":"1","event":{"hash":"2d05241c797c7b95da6af1eda0e216f0a76ed97e770b5b1007a0134f856490e2"},"ecs":{"version":"1.6.0"},"message":"1765337561.962212\tC4e2Ek4L7DR9t79Qn\t172.30.1.132\t3489\t8.8.8.8\t53\tudp\t50540\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:43.212Z","host":{"name":"f6b540842a86"},"log":{"offset":509626,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642413 Key: Timestamp: 2025-12-10 03:32:45.316 Headers: empty

{"@version":"1","event":{"hash":"5408225d1ffe1b7cef8f77f8d2b85f4a8bd0bc7c21a50000e079738d0061887a"},"ecs":{"version":"1.6.0"},"message":"1765337562.196006\tCMkWrovCLinV7yd1g\t172.30.1.12\t51401\t8.8.8.8\t53\tudp\t55230\t0.029523\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t270.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:44.213Z","host":{"name":"f6b540842a86"},"log":{"offset":509776,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642414 Key: Timestamp: 2025-12-10 03:32:45.316 Headers: empty

{"@version":"1","event":{"hash":"3989963b7ca3c4200d8d5c0af7f16f291a7e0955c7c731ee31c5278d8fdc1b23"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337552.889969\tC2Qx2wIdZX5UbXkJg\t172.30.1.12\t49424\t8.8.8.8\t53\tudp\tdns\t0.024865\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:44.651Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":508640},"tags":["beats_input_codec_plain_applied"]}

Offset: 642415 Key: Timestamp: 2025-12-10 03:32:46.318 Headers: empty

{"@version":"1","event":{"hash":"335d9344b369617f5166c9b71ca97fc4abf537c9961a242fff5f6cc469c757de"},"ecs":{"version":"1.6.0"},"message":"1765337564.275881\tCiuTTb25rE4B1Z655k\t172.30.1.12\t34168\t8.8.8.8\t53\tudp\t55232\t0.030124\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t54.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:46.215Z","host":{"name":"f6b540842a86"},"log":{"offset":510454,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642416 Key: Timestamp: 2025-12-10 03:32:46.318 Headers: empty

{"@version":"1","event":{"hash":"d6c12c60160c1d14dece5b019c9122bf82d3ecd9630199e9a3af2931a0ce532c"},"ecs":{"version":"1.6.0"},"message":"1765337563.235816\tCEABgh2EVUEdTd5B7i\t172.30.1.12\t35611\t8.8.8.8\t53\tudp\t55231\t0.029144\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t269.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:45.214Z","host":{"name":"f6b540842a86"},"log":{"offset":509950,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642417 Key: Timestamp: 2025-12-10 03:32:46.318 Headers: empty

{"@version":"1","event":{"hash":"0e39028432eefbd2d8ae3f8b4f835663e75b106884bb1d9934cf25b872be3047"},"ecs":{"version":"1.6.0"},"message":"1765337561.542809\tCGrjV634VCunFx1AQ7\t172.30.1.35\t62139\t172.30.1.254\t53\tudp\t22483\t2.016221\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2259.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:45.214Z","host":{"name":"f6b540842a86"},"log":{"offset":510125,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642418 Key: Timestamp: 2025-12-10 03:32:46.318 Headers: empty

{"@version":"1","event":{"hash":"15d6d4f2b18b637a7efd3a0de324b7319546b7669bcc4b971f611d556e414047"},"ecs":{"version":"1.6.0"},"message":"1765337561.962448\tCJtFaFfKcxSvkYYr7\t172.30.1.132\t3489\t172.30.1.254\t53\tudp\t50540\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:45.214Z","host":{"name":"f6b540842a86"},"log":{"offset":510299,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642419 Key: Timestamp: 2025-12-10 03:32:46.318 Headers: empty

{"@version":"1","event":{"hash":"4d2c00b475123c459c161531a7703c9e20c2ea9d96f97014a3c4ac95bd0be9d0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337553.925734\tCw1eDtCXz9TSnPsQ7\t172.30.1.12\t59311\t8.8.8.8\t53\tudp\tdns\t0.029790\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:45.651Z","host":{"name":"f6b540842a86"},"log":{"offset":508763,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642420 Key: Timestamp: 2025-12-10 03:32:47.755 Headers: empty

{"@version":"1","event":{"hash":"a70737525ac1409680d224aaabbf30f2fb22121d30a375b0f72d2a7f8bd0a779"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337554.965789\tCUrMnx31Yn2wWpJN2c\t172.30.1.12\t51939\t8.8.8.8\t53\tudp\tdns\t0.027747\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:46.652Z","host":{"name":"f6b540842a86"},"log":{"offset":508886,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642421 Key: Timestamp: 2025-12-10 03:32:47.755 Headers: empty

{"@version":"1","event":{"hash":"d49aa00164b8f19f3fa3eb4ce8284bffb24489e6ed11df04547eeaa14b422b53"},"ecs":{"version":"1.6.0"},"message":"1765337565.315848\tC9ENqcjOyVd8fpQ46\t172.30.1.12\t38401\t8.8.8.8\t53\tudp\t55233\t0.028888\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t53.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:47.215Z","host":{"name":"f6b540842a86"},"log":{"offset":510628,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642422 Key: Timestamp: 2025-12-10 03:32:48.756 Headers: empty

{"@version":"1","event":{"hash":"dd303b05a2a1d88d5754d7c2177d998e7d8cb31d8b4fc7e7b38f23d7dbffff6b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337555.995719\tC0QkrM1JZOJYeDOT1c\t172.30.1.12\t37211\t8.8.8.8\t53\tudp\tdns\t0.026820\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:47.652Z","host":{"name":"f6b540842a86"},"log":{"offset":509010,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642423 Key: Timestamp: 2025-12-10 03:32:48.756 Headers: empty

{"@version":"1","event":{"hash":"a9e42dcbf5f0131e0ed1a5651f08313594629aad1c432d320b161574b5574032"},"ecs":{"version":"1.6.0"},"message":"1765337566.355764\tCIAHiT2RDvtYwsbemc\t172.30.1.12\t39798\t8.8.8.8\t53\tudp\t55234\t0.029249\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t52.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:48.215Z","host":{"name":"f6b540842a86"},"log":{"offset":510970,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642424 Key: Timestamp: 2025-12-10 03:32:48.756 Headers: empty

{"@version":"1","event":{"hash":"59c80b1e03ad22c10c200c85feeea97af10e52479ee9ee18e49a9bc876596f2a"},"ecs":{"version":"1.6.0"},"message":"1765337566.588330\tCJGCc727wKy3ks2iy5\t172.30.1.35\t52278\t8.8.8.8\t53\tudp\t39184\t0.027066\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1295.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:32:48.215Z","host":{"name":"f6b540842a86"},"log":{"offset":510801,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642425 Key: Timestamp: 2025-12-10 03:47:05.054 Headers: empty

{"@version":"1","event":{"hash":"e718a3a782976466f61b36056d2a69416f4247135fb65583ffd907c14aee9cb9"},"ecs":{"version":"1.6.0"},"message":"1765338422.704221\tCIkT4g29M2UECriOL7\t172.30.1.12\t48030\t8.8.8.8\t53\tudp\t56071\t0.028272\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t10.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:03.951Z","host":{"name":"f6b540842a86"},"log":{"offset":716540,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642426 Key: Timestamp: 2025-12-10 03:47:06.054 Headers: empty

{"@version":"1","event":{"hash":"c7306567f864246e0a88bb74de642850ee877d938c853c7c4c6342e4638d855b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338414.414149\tCsgrQ9MhszJlo474k\t172.30.1.12\t43541\t8.8.8.8\t53\tudp\tdns\t0.030182\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:05.421Z","host":{"name":"f6b540842a86"},"log":{"offset":720006,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642427 Key: Timestamp: 2025-12-10 03:47:06.054 Headers: empty

{"@version":"1","event":{"hash":"204c30d7f209f6091239bae9793decc050497376e70bb743c03a83dd427b4049"},"ecs":{"version":"1.6.0"},"message":"1765338423.744230\tC04utG18uuXiJeV2X9\t172.30.1.12\t33478\t8.8.8.8\t53\tudp\t56072\t0.028814\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t95.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:04.951Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":716714},"tags":["beats_input_codec_plain_applied"]}

Offset: 642428 Key: Timestamp: 2025-12-10 03:47:06.054 Headers: empty

{"@version":"1","event":{"hash":"14809a87d5fed13fd9468b97680617b17d9bef4aa3117915d15e691cd986e33d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338413.384171\tCpsUaF2hOX43d0Ecf7\t172.30.1.12\t49440\t8.8.8.8\t53\tudp\tdns\t0.028020\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:05.421Z","host":{"name":"f6b540842a86"},"log":{"offset":719882,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642429 Key: Timestamp: 2025-12-10 03:47:07.525 Headers: empty

{"@version":"1","event":{"hash":"2619c9e420381dc8db6fcf2523370af936d7a81470c50c186eeac85922ca1a16"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338419.284836\tCZOSjL3UhMw2Oc56cl\t172.30.1.4\t43076\t8.214.27.19\t8666\ttcp\t-\t0.262389\t138\t205\tSF\tT\tF\t0\tShADadFf\t9\t614\t8\t629\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:06.421Z","host":{"name":"f6b540842a86"},"log":{"offset":720129,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642430 Key: Timestamp: 2025-12-10 03:47:08.525 Headers: empty

{"@version":"1","event":{"hash":"99324af7977d06585ec1df4931328993b581a575b822204a377c8b5c7384e712"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338415.454203\tCWUVzP2J3oigjnnABb\t172.30.1.12\t33667\t8.8.8.8\t53\tudp\tdns\t0.029459\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:07.422Z","host":{"name":"f6b540842a86"},"log":{"offset":720266,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642431 Key: Timestamp: 2025-12-10 03:47:08.525 Headers: empty

{"@version":"1","event":{"hash":"beb0c54a14ad6ae3a855c0917e8d23ccf7408938e1471203dc8d612690792762"},"ecs":{"version":"1.6.0"},"message":"1765338425.544515\tCXYSdb4yxB5YCVmD0g\t172.30.1.132\t24895\t8.8.8.8\t53\tudp\t26293\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:07.952Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":717062},"tags":["beats_input_codec_plain_applied"]}

Offset: 642432 Key: Timestamp: 2025-12-10 03:47:08.525 Headers: empty

{"@version":"1","event":{"hash":"22035f2eaf7de698f4a90afdbf6819a21e999aeebedbb80a2863b0330abec3b1"},"ecs":{"version":"1.6.0"},"message":"1765338425.544258\tCOW72c1857oB9htcXf\t172.30.1.132\t24895\t172.30.1.254\t53\tudp\t26293\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:07.952Z","host":{"name":"f6b540842a86"},"log":{"offset":717214,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 642433 Key: Timestamp: 2025-12-10 03:47:08.525 Headers: empty

{"@version":"1","event":{"hash":"75eab3ef3d6a375185cec54b0fd92d64a061f424ea87f3430a5b28179df5f97e"},"ecs":{"version":"1.6.0"},"message":"1765338426.600930\tC2w3X81phsgpG3JVj5\t172.30.1.35\t59770\t8.8.8.8\t53\tudp\t6406\t0.028036\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3518.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:47:07.952Z","host":{"name":"f6b540842a86"},"log":{"offset":717546,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network