Kafdrop

{"@version":"1","event":{"hash":"db76487ca00e39b4ebd8022e174e2de6525fcc0efded9358e0f9fb16ee1770b0"},"ecs":{"version":"1.6.0"},"message":"1765248705.644421\tCRfJPu1YQYyVI6iPpe\t172.30.1.12\t54158\t172.30.1.254\t53\tudp\t33485\t0.003000\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:47.386Z","host":{"name":"f6b540842a86"},"log":{"offset":788593,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"604e4aabf60c97d97fb548d12a8ef53dd8171c0d69cd0a998457cea37f4f3b04"},"ecs":{"version":"1.6.0"},"message":"1765248706.743777\tCNZATz1lmdk40SpzRj\t172.30.1.35\t49632\t172.30.1.254\t53\tudp\t56505\t0.005349\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t925.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.386Z","host":{"name":"f6b540842a86"},"log":{"offset":788948,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"114f437b020feecde5621062bd84ff5e1b69d794e477e77de0a794771ccf150c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248695.544488\tCFDDd7a1Iuua9ZI9\t172.30.1.12\t40153\t172.30.1.254\t53\tudp\tdns\t0.002648\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:47.821Z","host":{"name":"f6b540842a86"},"log":{"offset":804430,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"93084867c031c94f6ff22cd482a2875de488c872281c372e0d18ec276ea73e5e"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248699.164279\tCasyZH3jyn2aYpkNQa\t172.30.1.35\t64096\t104.208.16.92\t443\ttcp\tssl\t1.484078\t2483\t4720\tSF\tT\tF\t0\tSAhDdaFfR\t13\t3015\t12\t5212\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:47.821Z","host":{"name":"f6b540842a86"},"log":{"offset":804557,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d41d2a03b9c1ba4cc60f9d5bd091eb2948cfb732941961c6cf3402f793a5f6d3"},"ecs":{"version":"1.6.0"},"message":"1765248706.654420\tCNw5f2mwSlP01bo56\t172.30.1.12\t52668\t172.30.1.254\t53\tudp\t33486\t0.002946\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t179.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.386Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":788771},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1ea18bafebed77abeea769c0606587e837ff8f8e99f2fb596b57e0225075dc0a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248696.554320\tCV2KBs17XSIm4TaDSd\t172.30.1.12\t55744\t172.30.1.254\t53\tudp\tdns\t0.003200\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.822Z","host":{"name":"f6b540842a86"},"log":{"offset":804705,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f3cdd7bb7ac4a53f627850b84d5598a4e928820c1c35ce08ba67747b3eb6ad8c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248697.564424\tCTMKEo3bJvgyF6yptl\t172.30.1.12\t42649\t172.30.1.254\t53\tudp\tdns\t0.003096\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.822Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":805090},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9863fbc482505bf1b3035270f54369ad24d8e34d9bbd77a5fb9ccf0661c87f88"},"ecs":{"version":"1.6.0"},"message":"1765248707.720521\tCyad2E2lguFCNTxC7f\t172.30.1.12\t35567\t172.30.1.254\t53\tudp\t33487\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:49.387Z","host":{"name":"f6b540842a86"},"log":{"offset":789121,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cc8b8db710933a065c955b0ff3b9940d6425e79e1c1f289b012908902f13f912"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248696.738318\tCpdw9X1Xr3SZC9gmy5\t172.30.1.35\t63991\t172.30.1.254\t53\tudp\tdns\t0.004831\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.822Z","host":{"name":"f6b540842a86"},"log":{"offset":804959,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d083181365db08255ecc8deffebae601a6074af4d6efa83bf29215bcc9f850c4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248702.603429\tCt2NQ42QUvQ5aBWtW3\t172.30.1.2\t39132\t172.30.4.139\t1515\ttcp\t-\t2.999258\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:48.822Z","host":{"name":"f6b540842a86"},"log":{"offset":804834,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"804e1cfb58f9d831350b7e4d22f1587b8b6a70b27546e544505f5a194d16699f"},"ecs":{"version":"1.6.0"},"message":"1765248699.399542\tCasyZH3jyn2aYpkNQa\t172.30.1.35\t64096\t104.208.16.92\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp384r1\tv10.events.data.microsoft.com\tF\t-\th2\tT\tFrevnN3Tqn9oGEDUwj,FsJYqsaKEEL656RPk\t(empty)\tCN=*.events.data.microsoft.com,OU=WSE,O=Microsoft,L=Redmond,ST=WA,C=US\tCN=Microsoft Secure Server CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\t-\t-\tunable to get local issuer certificate\t28a2c9bd18a11de089ef85a160da29e4\t2fe9b0e731d3d41b2b84e8e1d6186836","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:49.709Z","host":{"name":"f6b540842a86"},"log":{"offset":27578,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5bad7203de92388e1c55220673c708ede8a469da0e5d98ff34eb6b1add1c10d6"},"ecs":{"version":"1.6.0"},"message":"1765248708.683192\tCWVfaN1b010BW4A656\t172.30.1.12\t47484\t172.30.1.254\t53\tudp\t33488\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:50.387Z","host":{"name":"f6b540842a86"},"log":{"offset":789292,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"026fb12816a0d1c94922120e0a573434759277b819e9b523921e72871b7ded5f"},"ecs":{"version":"1.6.0"},"message":"1765248699.646566\tFrevnN3Tqn9oGEDUwj\t3\t33000003A322FF814CF22F6FD70000000003A3\tCN=*.events.data.microsoft.com,OU=WSE,O=Microsoft,L=Redmond,ST=WA,C=US\tCN=Microsoft Secure Server CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\t1747449074.000000\t1778985074.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\t*.events.data.microsoft.com,events.data.microsoft.com,*.vortex-win.data.microsoft.com,vortex-win.data.microsoft.com,*.vortex.data.microsoft.com,vortex.data.microsoft.com,*.events.data.microsoft.us,events.data.microsoft.us,*.vortex-win.data.microsoft.us,vortex-win.data.microsoft.us,*.vortex.data.microsoft.us,vortex.data.microsoft.us,*.events.endpoint.security.microsoft.us,events.endpoint.security.microsoft.us,*.events.endpoint.security.microsoft.com,events.endpoint.security.microsoft.com\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:50.683Z","host":{"name":"f6b540842a86"},"log":{"offset":22894,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e53d6730451bc1a90343ba43e1cef1820f8754a0c299153ec1496662e4c7a678"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248703.531891\tCGhYSjTeTaXX6f6f5\t172.30.1.63\t58532\t172.30.2.171\t5044\ttcp\t-\t2.048019\t0\t0\tS0\tT\tT\t0\tS\t2\t120\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:49.827Z","host":{"name":"f6b540842a86"},"log":{"offset":805219,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4008b45cfc9eab30d2de0af01ffa8d2d386777de87dfe38b2f5db4a6025c14fd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248698.574358\tC5I2rr2onY2NpGncxd\t172.30.1.12\t52997\t172.30.1.254\t53\tudp\tdns\t0.003313\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:50.828Z","host":{"name":"f6b540842a86"},"log":{"offset":805344,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0a8f3c9a52d27e91bb844eaff1e01d22ff4b70e0f7e9dd39d54b0a4de439dbaf"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248699.159334\tCJUWL31eNVOCacONl8\t172.30.1.35\t49853\t172.30.1.254\t53\tudp\tdns\t0.003252\t47\t190\tSF\tT\tT\t0\tDd\t1\t75\t1\t218\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:50.828Z","host":{"name":"f6b540842a86"},"log":{"offset":805473,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5f133311083dc98405dde60d146421cb68e190b1274f2e557e05307b70b4305c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248699.584344\tCj4mX318eilfIdbxh\t172.30.1.12\t44939\t172.30.1.254\t53\tudp\tdns\t0.003483\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:50.828Z","host":{"name":"f6b540842a86"},"log":{"offset":805604,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"20189dd9081cf61668cb5a628ffcc351e6920149baccdc22fac4a5c668b53c7d"},"ecs":{"version":"1.6.0"},"message":"1765248709.700336\tCR3inUkQcJsoghzW2\t172.30.1.12\t45355\t172.30.1.254\t53\tudp\t33489\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:51.387Z","host":{"name":"f6b540842a86"},"log":{"offset":789463,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5147dc4748435dcbda8f62a22bc2c42d51163c8bcdecb39c6825b8b5e93292e8"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248705.561660\tCKNkui1I4shA6jtoTe\t172.30.1.2\t40530\t172.30.4.136\t5044\ttcp\t-\t2.990685\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:51.829Z","host":{"name":"f6b540842a86"},"log":{"offset":805732,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"71bae9015faf110450d6dc02ba91cbd690d9fa39910bf0aeba55f9582d8ba6b2"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248700.594470\tCMmgkG3in5ObN5Mjmk\t172.30.1.12\t56558\t172.30.1.254\t53\tudp\tdns\t0.005155\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:52.830Z","host":{"name":"f6b540842a86"},"log":{"offset":805857,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9fc9e9c84402a184619666afe994cbc1b279ffbfb8a51bf4fcbe652347bea674"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248701.604359\tCo1ocm3F1bSA8oCZqi\t172.30.1.12\t44993\t172.30.1.254\t53\tudp\tdns\t0.003671\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:52.830Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":805986},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e34b35d2095c05b9b108bfe0f9ca9038207ed2fbd8d8d4266db0aec4aa888890"},"ecs":{"version":"1.6.0"},"message":"1765248710.694465\tC3vrn12YbEgF0N6JI9\t172.30.1.12\t56634\t172.30.1.254\t53\tudp\t33490\t0.003528\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:52.388Z","host":{"name":"f6b540842a86"},"log":{"offset":789633,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"992c36c184e525d714a53ccdd1cd79a92a5e38d578b70e9dd438b72396228c4a"},"ecs":{"version":"1.6.0"},"message":"1765248711.730591\tCyaqrW2wL0seH3ajbg\t172.30.1.35\t51406\t172.30.1.254\t53\tudp\t7723\t0.025342\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1140.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:53.390Z","host":{"name":"f6b540842a86"},"log":{"offset":789811,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"520fd32d8ca45fab3b62699398e6d58e9f0a4877688003e1b451d423d9da6be3"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248701.742240\tCzdctPJ7IAHylCUw9\t172.30.1.35\t54648\t172.30.1.254\t53\tudp\tdns\t0.006672\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:53.831Z","host":{"name":"f6b540842a86"},"log":{"offset":806244,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b87b5bfb622851aa1e2fbc24c3d969fef9c4d7419a2cf6473be44fdcd5e60a0b"},"ecs":{"version":"1.6.0"},"message":"1765248711.704576\tCIke324QVbTby97jRg\t172.30.1.12\t40864\t172.30.1.254\t53\tudp\t33491\t0.003372\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:53.390Z","host":{"name":"f6b540842a86"},"log":{"offset":789984,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"034f8ca5b1b425eae127425b2bf93533e5ba14bfd7dd93320b8210ac3e16901d"},"ecs":{"version":"1.6.0"},"message":"1765248712.779930\tCtvI2c0Y5dB56SrA2\t172.30.1.12\t41373\t172.30.1.254\t53\tudp\t33492\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:54.390Z","host":{"name":"f6b540842a86"},"log":{"offset":790162,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"de1901240fe4b3c85cd2e58767c61a14f59bfa0f3da918c2d441a2bf7554f18c"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248702.614379\tCzQPL53ZwIXjlqPwgg\t172.30.1.12\t58632\t172.30.1.254\t53\tudp\tdns\t0.002907\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:53.831Z","host":{"name":"f6b540842a86"},"log":{"offset":806115,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1cfd5f32e3dacff08735151fd8622e981ea367a9fc47f6b0a39844671b509cfc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248708.663588\tCKlN4s1tkocvonKoQc\t10.10.10.1\t51896\t10.10.10.202\t8000\ttcp\t-\t0.033114\t32\t0\tSH\tT\tT\t0\tSADF\t6\t352\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:55.832Z","host":{"name":"f6b540842a86"},"log":{"offset":806503,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e63bb41af2ec6b38401ba1002406d32246dc38763d2e3cd317f1b5741c769444"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248709.611920\tCNy6Bn4E40kPaqiz1k\t172.30.1.63\t58532\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:55.832Z","host":{"name":"f6b540842a86"},"log":{"offset":806632,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3df6a1b3cbc6595104fbb74c5cc05c5ce9274997ea4bd10ccca223efa016fd77"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248704.634547\tCWWrci2YqfmebHgzPe\t172.30.1.12\t48180\t172.30.1.254\t53\tudp\tdns\t0.003584\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:55.832Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":806750},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"18cb7cddf06e5443ce70a45fdd2f3c03c1fe67359bd2e457c4b8d2b41f00c97d"},"ecs":{"version":"1.6.0"},"message":"1765248713.724533\tCZ6XW2Rnc21wcDCwe\t172.30.1.12\t59629\t172.30.1.254\t53\tudp\t33493\t0.003806\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:55.390Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":790332},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e26c84f531731ab58b75653245cc672ec0267d12bb9fde53b2899806d5d16f81"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248703.624436\tC9ijLB3eH9SPdcmR29\t172.30.1.12\t53096\t172.30.1.254\t53\tudp\tdns\t0.002708\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:54.831Z","host":{"name":"f6b540842a86"},"log":{"offset":806374,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"44bb18e2d2d02605cc9b77adafd1317c349d03e4f843f77f9c5d15f7ee0bb11b"},"ecs":{"version":"1.6.0"},"message":"1765248714.734491\tCqCSdc2k79YdNFUcX6\t172.30.1.12\t59234\t172.30.1.254\t53\tudp\t33494\t0.002995\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:56.391Z","host":{"name":"f6b540842a86"},"log":{"offset":790509,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ef3b94bf9ab58ffe4de9fe2cfe25357951658699a349c50b7a499f2b8a921ed0"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248705.644421\tCRfJPu1YQYyVI6iPpe\t172.30.1.12\t54158\t172.30.1.254\t53\tudp\tdns\t0.003000\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:56.832Z","host":{"name":"f6b540842a86"},"log":{"offset":806879,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"daae1dc6863864982a6e05d8c6325175ace5418a77b5bfa4debe53f9f429d2a1"},"ecs":{"version":"1.6.0"},"message":"1765248715.744582\tCtFSV52cHWpqFehfqb\t172.30.1.12\t56078\t172.30.1.254\t53\tudp\t33495\t0.002852\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:57.391Z","host":{"name":"f6b540842a86"},"log":{"offset":790687,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"610710cff638e9789ae92c8a93f031c8c0bd8e5db544346fdce6bfb7816de5fc"},"ecs":{"version":"1.6.0"},"message":"1765248716.769463\tCQb7bc3dgg9sMua1ih\t172.30.1.35\t60604\t172.30.1.254\t53\tudp\t18081\t0.313048\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t914.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:58.392Z","host":{"name":"f6b540842a86"},"log":{"offset":791036,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"996df15426e7f94ac0afe9929a472a178456f9554bc9222515704157fff1ccca"},"ecs":{"version":"1.6.0"},"message":"1765248716.769463\tCFXqwJ3HbzARwKCU17\t172.30.1.12\t45083\t172.30.1.254\t53\tudp\t33496\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:58.391Z","host":{"name":"f6b540842a86"},"log":{"offset":790865,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"af468f4f5395590f98a69d4207bfa6ba52ff7827030bc852176c92b506b4049b"},"ecs":{"version":"1.6.0"},"message":"1765248716.781735\tCgIKe13DLZPzA15eCg\t172.30.1.35\t60604\t8.8.8.8\t53\tudp\t18081\t0.108879\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3417.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:58.392Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":791209},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"901e64a36883cad81509f6a725c66f994354c7aed7144474fa75508a206830ef"},"ecs":{"version":"1.6.0"},"message":"1765248717.766214\tC9MMdX2HKoajEvu7S5\t172.30.1.12\t57485\t172.30.1.254\t53\tudp\t33497\t0.001510\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.392Z","host":{"name":"f6b540842a86"},"log":{"offset":791378,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bba103f16b6894a949a735672797de27d25931a3b2858e6dcbee9c0c45926c51"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248706.654420\tCNw5f2mwSlP01bo56\t172.30.1.12\t52668\t172.30.1.254\t53\tudp\tdns\t0.002946\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.834Z","host":{"name":"f6b540842a86"},"log":{"offset":807008,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"064e2ca243434e75dd7a1365d37198f2ad578e4a38a51f2ccfa9703fbfc1d5be"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248651.848776\tCev4VA4BEYlvdEhcS5\t172.30.1.4\t39729\t154.41.93.195\t6101\tudp\t-\t5.319259\t5600\t980\tSF\tT\tF\t0\tDd\t35\t6580\t5\t1120\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.834Z","host":{"name":"f6b540842a86"},"log":{"offset":807267,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9375c4a27e3260f1b26d029cf0685c35bbbd92fc2b4718a789c3774c496887b4"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248706.743777\tCNZATz1lmdk40SpzRj\t172.30.1.35\t49632\t172.30.1.254\t53\tudp\tdns\t0.005349\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.834Z","host":{"name":"f6b540842a86"},"log":{"offset":807136,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ee7685ed112b6222e3dad03b2d994fa59a0780d64f143385178d77dbb50753d6"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248707.664465\tCyad2E2lguFCNTxC7f\t172.30.1.12\t35567\t172.30.1.254\t53\tudp\tdns\t0.002886\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.834Z","host":{"name":"f6b540842a86"},"log":{"offset":807404,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b3111d744c40cc8d74653b38567bae5308d2dfb6db8c517f67c5a261ad6f2b5c"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248708.680168\tCWVfaN1b010BW4A656\t172.30.1.12\t47484\t172.30.1.254\t53\tudp\tdns\t0.000454\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:51:59.834Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":807533},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"93fc53781d1a1e47091a4e3c5a58d75f10c13e750ade8c263a1826b1275d7d5f"},"ecs":{"version":"1.6.0"},"message":"1765248718.774645\tC7yfg02HLpVSdA403b\t172.30.1.12\t46038\t172.30.1.254\t53\tudp\t33498\t0.002970\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:00.393Z","host":{"name":"f6b540842a86"},"log":{"offset":791556,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fe8c564f37f78cc1f6fa1791a78c21d62415e7c0554d522082156aa221ed0be8"},"ecs":{"version":"1.6.0"},"message":"1765248719.784522\tCLEsd9Wl5KIHQzLhk\t172.30.1.12\t50957\t172.30.1.254\t53\tudp\t33499\t0.003131\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:01.394Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":791734},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0577cfb84bb5e6b62bf30809f3491921c300ed12eca37937275ef3474c556289"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248715.603683\tCtVz9i3m151xYdx2sg\t172.30.1.2\t32860\t172.30.4.139\t1514\ttcp\t-\t2.998696\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":808050,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ca79bf2132a3940d0dd92ad8afc3f3e4a5db3824eddf863f1634a0f894af02fa"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248657.122574\tC6mqeD3mgy3Lwdmr8i\t172.30.1.4\t39729\t154.41.93.195\t6102\tudp\t-\t4.164108\t4000\t980\tSF\tT\tF\t0\tDd\t25\t4700\t5\t1120\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":808175,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e96c7318e79c78ab6fc5a0fba8b7c293be534bb5a96bd451befaaee9c77a9a64"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248711.704576\tCIke324QVbTby97jRg\t172.30.1.12\t40864\t172.30.1.254\t53\tudp\tdns\t0.003372\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":808312,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"75e04279c469de3cd8deba32b8cfe50853d699a11d6cbd2c7c5d3571db60ea73"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248660.417267\tCnr13U6DO4dOB0Bej\t172.30.1.14\t3072\t239.255.255.250\t1900\tudp\t-\t0.011048\t2390\t0\tS0\tT\tF\t0\tD\t8\t2614\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":807790,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"01a898bca669082a324743b721e7108579d2ed6b9dfb584c49bfe163777b8513"},"ecs":{"version":"1.6.0"},"message":"1765248720.794566\tCbKzIy1Cixlp1GXWF7\t172.30.1.12\t47244\t172.30.1.254\t53\tudp\t33500\t0.003631\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.395Z","host":{"name":"f6b540842a86"},"log":{"offset":791911,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3d47f9ab5bb652c6ff5bfdec51a0728b3545dac0de33bef65f2f0b4e14deae6c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248715.724900\tCC6FY31R8lCBAudjz3\t10.10.10.1\t51898\t10.10.10.202\t8000\ttcp\t-\t0.108991\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":808441,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1464322ef4fd77db0ed722b0c5c122c928797db13f6de8ce644c7a683fbf4f63"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248710.694465\tC3vrn12YbEgF0N6JI9\t172.30.1.12\t56634\t172.30.1.254\t53\tudp\tdns\t0.003528\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"offset":807921,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"75439f6834c0e69ce158af94bd875b2cad6d348d23361a943f1efef0b7fe1ae0"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248709.684636\tCR3inUkQcJsoghzW2\t172.30.1.12\t45355\t172.30.1.254\t53\tudp\tdns\t0.003373\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.834Z","host":{"name":"f6b540842a86"},"log":{"offset":807662,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"268eeda4a1ba9273ca45fa71eec72422bfc92bc51f04d49398f87b894e7e7b43"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248711.730591\tCyaqrW2wL0seH3ajbg\t172.30.1.35\t51406\t172.30.1.254\t53\tudp\tdns\t0.025342\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:02.835Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":808570},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1983d522f9c6088ab33175de519af441ae89913b769880ff6d798d09622a1cbb"},"ecs":{"version":"1.6.0"},"message":"1765248721.736509\tCGvFWSSol4F5aEmSk\t172.30.1.35\t51334\t172.30.1.254\t53\tudp\t5703\t0.022109\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t910.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:03.396Z","host":{"name":"f6b540842a86"},"log":{"offset":792267,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bcd9481f9bf050c6f4e0d01cfb67c43744b480e9c0ec543bacc89e5825ab73f1"},"ecs":{"version":"1.6.0"},"message":"1765248721.804535\tCmWOV44oeiWtKNn1I7\t172.30.1.12\t58738\t172.30.1.254\t53\tudp\t33501\t0.003675\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:03.396Z","host":{"name":"f6b540842a86"},"log":{"offset":792089,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"99019c6c7d3421f597fe03ab801a259539d84933c78678f8ae70be6d3711e0e9"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248716.964120\tC2xp4j2uJqDEqMqeY9\t10.10.10.1\t49316\t10.10.10.203\t8000\ttcp\t-\t0.115440\t36\t0\tSH\tT\tT\t0\tSADF\t6\t356\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:03.835Z","host":{"name":"f6b540842a86"},"log":{"offset":808701,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"706adf05b69204e89104ef0375266a5439655ac1017998f710b3bc5bc89d1e34"},"ecs":{"version":"1.6.0"},"message":"1765248722.832996\tCLTyz7265Imj4ssNtg\t172.30.1.12\t34405\t172.30.1.254\t53\tudp\t33502\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:04.396Z","host":{"name":"f6b540842a86"},"log":{"offset":792438,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b3c0a7e5dab8e98c4c2b139f33c07f302103af8163e081fc0842d1f720a44611"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248712.714500\tCtvI2c0Y5dB56SrA2\t172.30.1.12\t41373\t172.30.1.254\t53\tudp\tdns\t0.003740\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:04.835Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":808830},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"14c2deeec08e06d05a155de23f83cb32ce36e642325df4a00d4aff305a5839ff"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248713.724533\tCZ6XW2Rnc21wcDCwe\t172.30.1.12\t59629\t172.30.1.254\t53\tudp\tdns\t0.003806\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:04.835Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":808958},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d79907835a2a0c806cb1f853c94f2af4177319f601c2bb71d98eae7d6e53125c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248717.867913\tCXiUn926V4frHW9Zrc\t172.30.1.63\t58532\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:04.835Z","host":{"name":"f6b540842a86"},"log":{"offset":809086,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bf80e9fab67d66737fd27cec4ebc7ece0ced1a994d1763dc0fa2b5bfb47f3536"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248714.734491\tCqCSdc2k79YdNFUcX6\t172.30.1.12\t59234\t172.30.1.254\t53\tudp\tdns\t0.002995\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:05.836Z","host":{"name":"f6b540842a86"},"log":{"offset":809204,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"86a86b66c74f03784b3adfd38a711b5f24deb26e652099d3cacbc802ba230c1a"},"ecs":{"version":"1.6.0"},"message":"1765248724.834569\tCIKQ8g373zV7UhZ2qi\t172.30.1.12\t60455\t172.30.1.254\t53\tudp\t33504\t0.002846\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:06.397Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":792787},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"82de645f26fe4f8aef74580cd4c695d1924c3a83f0bf6d3f6882e1f569a31fa5"},"ecs":{"version":"1.6.0"},"message":"1765248723.824544\tCxV7Ez2kfOmiFwekV4\t172.30.1.12\t58011\t172.30.1.254\t53\tudp\t33503\t0.002945\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:05.397Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":792609},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4c08871061bc5dd3353892214c7b96dc87c607be9609ae2153bc5211974e02f5"},"ecs":{"version":"1.6.0"},"message":"1765248725.883460\tCNHwiM1fM5kXqw1nd8\t172.30.1.12\t58604\t172.30.1.254\t53\tudp\t33505\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:07.397Z","host":{"name":"f6b540842a86"},"log":{"offset":792965,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f69ab1659e237d68f5e3abcb52fe4ed2746da51eb7498b79eda2dfe7c82aeaaa"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248715.744582\tCtFSV52cHWpqFehfqb\t172.30.1.12\t56078\t172.30.1.254\t53\tudp\tdns\t0.002852\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:06.836Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":809333},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6fb1f36b0aa62083fa0c8b4456144d6036c19dd697354cc21b3e4f5661cf0470"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248716.781735\tCgIKe13DLZPzA15eCg\t172.30.1.35\t60604\t8.8.8.8\t53\tudp\tdns\t0.026391\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:07.837Z","host":{"name":"f6b540842a86"},"log":{"offset":809462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8bb473cd5ba4ae75cc0c9196b0e1aee8f8b4cadf5014fb22fbaf5df8ef49c5d5"},"ecs":{"version":"1.6.0"},"message":"1765248726.735207\tCIcow82741bgifQFPf\t172.30.1.35\t57611\t172.30.1.254\t53\tudp\t65438\t0.626585\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t904.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.398Z","host":{"name":"f6b540842a86"},"log":{"offset":793483,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fa6bf3b2c8c25826795f8fb24caa69c89e179e0bbc720cd535cc48a7d79a1f85"},"ecs":{"version":"1.6.0"},"message":"1765248726.854583\tCbAndX1VGAuPumscWc\t172.30.1.12\t41299\t172.30.1.254\t53\tudp\t33506\t0.003063\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.398Z","host":{"name":"f6b540842a86"},"log":{"offset":793305,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5f552b66d49d1ec673692abf648670dd09530e727624d939adbc5b249ec360a6"},"ecs":{"version":"1.6.0"},"message":"1765248726.778129\tCb5vhL3LyWB1ZbWj57\t172.30.1.35\t57611\t8.8.8.8\t53\tudp\t65438\t0.023702\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1049.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.398Z","host":{"name":"f6b540842a86"},"log":{"offset":793136,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0affdf29d09395ea649e47a887bb2b4388cac8800da9de89c92fb3823880d090"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248716.742547\tCQb7bc3dgg9sMua1ih\t172.30.1.35\t60604\t172.30.1.254\t53\tudp\tdns\t0.339964\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.837Z","host":{"name":"f6b540842a86"},"log":{"offset":809588,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5f9b02fa6c86dba6992eddef272c7d493467c89d5d93e88b7e1c151c0505d8c2"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248717.766214\tC9MMdX2HKoajEvu7S5\t172.30.1.12\t57485\t172.30.1.254\t53\tudp\tdns\t0.001510\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.837Z","host":{"name":"f6b540842a86"},"log":{"offset":809978,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7bb7667eff6c556a7a4144ce653ae199fad61bb3e45f7060ae7ff41955178b6b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765246437.531459\tCUzgCXzC5vUA6ur7f\t10.10.10.1\t51600\t10.10.10.202\t8000\ttcp\t-\t2284.771465\t0\t0\tSH\tT\tT\t0\tAF\t1607\t84020\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.837Z","host":{"name":"f6b540842a86"},"log":{"offset":810107,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7e9ae810b0653c78f8fa2c4224b91b07b598123e2c5845c050eefa9cebeb7d1e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248716.754501\tCFXqwJ3HbzARwKCU17\t172.30.1.12\t45083\t172.30.1.254\t53\tudp\tdns\t0.002914\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.837Z","host":{"name":"f6b540842a86"},"log":{"offset":809719,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bf01ae236dd0339500d1be58c2f658978136f45236a2ccbb1b24254d78880941"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248722.303195\tCVx3BJ1x0mHyLVdaW8\t10.10.10.1\t51902\t10.10.10.202\t8000\ttcp\t-\t2.456670\t32\t0\tS0\tT\tT\t0\tSAD\t35\t1860\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:08.837Z","host":{"name":"f6b540842a86"},"log":{"offset":809848,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3be965e0358bcb59be9bed1f5dc55e3459cfade7f631c2fe5b31bea1bc3a7454"},"ecs":{"version":"1.6.0"},"message":"1765248727.864628\tCPDHfs3DnVnos0jAS1\t172.30.1.12\t50700\t172.30.1.254\t53\tudp\t33507\t0.003164\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:09.398Z","host":{"name":"f6b540842a86"},"log":{"offset":793656,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d5294c985d7a569b8840de36df61e64871099546ba25ebb0ba4fe18e1e855885"},"ecs":{"version":"1.6.0"},"message":"1765248729.884687\tCgMbBA4zmrW2XbUtfh\t172.30.1.12\t50435\t172.30.1.254\t53\tudp\t33509\t0.002938\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:11.399Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":794012},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"05a393d69ab503c08c4c81785b2c4d4e11f9b60970e451314dfb7c130729a666"},"ecs":{"version":"1.6.0"},"message":"1765248728.874627\tCpe5Eq2xp8qBSHd648\t172.30.1.12\t36053\t172.30.1.254\t53\tudp\t33508\t0.003060\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:10.398Z","host":{"name":"f6b540842a86"},"log":{"offset":793834,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a28df941d83846245b46d7684685e893a81241b05976c8441d7a5baae18dd348"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248725.375788\tCifObFE5JwhbO2xHe\t10.10.10.1\t51904\t10.10.10.202\t8000\ttcp\t-\t0.100823\t56\t0\tSH\tT\tT\t0\tSADF\t6\t376\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:11.838Z","host":{"name":"f6b540842a86"},"log":{"offset":810497,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ea453c6de46e06c067d5894d0ae9f9509ee3e6dc47a0a9ce81ad17c776dec522"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248718.774645\tC7yfg02HLpVSdA403b\t172.30.1.12\t46038\t172.30.1.254\t53\tudp\tdns\t0.002970\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:11.838Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":810240},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"17d415fd89eac02cc3923ca516976bb123e8f5f8d27815519f0bfb08054ab0c6"},"ecs":{"version":"1.6.0"},"message":"1765248731.775272\tClAcZf1w5C2NnC6pe\t172.30.1.35\t64117\t8.8.8.8\t53\tudp\t49734\t0.028210\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3057.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.399Z","host":{"name":"f6b540842a86"},"log":{"offset":794367,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0bf1c60997a5371f998fa23c56f0365d1875abbd57ec5a6c9b1bffa1662f8c44"},"ecs":{"version":"1.6.0"},"message":"1765248730.894915\tCdA1Ca2rjzuSZLutf\t172.30.1.12\t45768\t172.30.1.254\t53\tudp\t33510\t0.002953\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.399Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":794190},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"589df4709ff8535c1b773b8784c81f82cc69e75bc69b9103a5ffc1730f899afb"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248719.784522\tCLEsd9Wl5KIHQzLhk\t172.30.1.12\t50957\t172.30.1.254\t53\tudp\tdns\t0.003131\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:11.838Z","host":{"name":"f6b540842a86"},"log":{"offset":810369,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9abbfa6a5a79f591c851fe4c9b89b6cf75350d36fa5599a45bbf0f59cb02c6f1"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248725.465683\tCy1gbh3Y7t9J7artf\t10.10.10.1\t49526\t10.10.10.200\t8000\ttcp\t-\t0.249882\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.840Z","host":{"name":"f6b540842a86"},"log":{"offset":810625,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9d17d5f7e64e9657f9a95dadcd0d682fa6049183642e24a46a30c9f0f1132ff1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765248725.715774\tCWXYGj43r0Y1pvsvFc\t10.10.10.1\t36982\t10.10.10.201\t8000\ttcp\t-\t0.138682\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.844Z","host":{"name":"f6b540842a86"},"log":{"offset":810882,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2703a869edef854e46d9134d5d44519c3fdc159b60f910f9a3204a00a39c05f9"},"ecs":{"version":"1.6.0"},"message":"1765248731.904673\tCMDAyH3UXsmuSL5D0e\t172.30.1.12\t54807\t172.30.1.254\t53\tudp\t33511\t0.003523\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:13.400Z","host":{"name":"f6b540842a86"},"log":{"offset":794535,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"63701622f65c32e8060349cc6c590cd23a350b782f2984c21f9bde51e7f49f78"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765248725.854690\tC6ZnoB3i5B6SszI7w5\t10.10.10.1\t49326\t10.10.10.203\t8000\ttcp\t-\t0.170823\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.844Z","host":{"name":"f6b540842a86"},"log":{"offset":811011,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"96d192121f719fc47e594abc347a73b8f1bed4c9708fa2714ae873f6eed1b556"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248720.794566\tCbKzIy1Cixlp1GXWF7\t172.30.1.12\t47244\t172.30.1.254\t53\tudp\tdns\t0.003631\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:12.844Z","host":{"name":"f6b540842a86"},"log":{"offset":810753,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"054e163f1b6e2bf1b338a4bff1f6dd794368aa49bb7d5bafcf4a768bb84baedc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765248721.736509\tCGvFWSSol4F5aEmSk\t172.30.1.35\t51334\t172.30.1.254\t53\tudp\tdns\t0.022109\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:13.845Z","host":{"name":"f6b540842a86"},"log":{"offset":811140,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f86ccd5d92d5a4e22854d48615ed89add9fef74be5fdca9a67dd8110478825ad"},"ecs":{"version":"1.6.0"},"message":"1765248731.735574\tCn90283m6YpyXjcq97\t172.30.1.35\t64117\t172.30.1.254\t53\tudp\t49734\t2.016776\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:14.401Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":794890},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ca0dcd633455f3b80f00f9803cd4c47c2d4af84d34830432d754a279a5facd8f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765248721.804535\tCmWOV44oeiWtKNn1I7\t172.30.1.12\t58738\t172.30.1.254\t53\tudp\tdns\t0.003675\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:13.845Z","host":{"name":"f6b540842a86"},"log":{"offset":811270,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a057f54cfc7d69a87e15f0c5fab537ea81ff82a0fde0ccb46daed08b662e47f1"},"ecs":{"version":"1.6.0"},"message":"1765248732.914776\tCtzDNEW7VyRaZ4LY3\t172.30.1.12\t46385\t172.30.1.254\t53\tudp\t33512\t0.003422\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t119.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T02:52:14.401Z","host":{"name":"f6b540842a86"},"log":{"offset":794713,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d6b7eb41c50c9424dc5c3182fa8f9668a106289f850d7f87c8f117fa4d78e519"},"ecs":{"version":"1.6.0"},"message":"1765249236.779895\tCsrnSQ37fAB1Gj8Rag\t172.30.1.35\t54468\t8.8.8.8\t53\tudp\t33555\t0.028617\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2897.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:38.668Z","host":{"name":"f6b540842a86"},"log":{"offset":9505,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6bce0891b0d0bde9b3aab41a1ea445ea979550f340dd26213c5bc8b0e6448621"},"ecs":{"version":"1.6.0"},"message":"1765249235.992294\tCaJPwo3oJw5mVrQWch\t172.30.1.12\t56954\t172.30.1.254\t53\tudp\t34010\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:38.668Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":9334},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0fe6855102ff2472688343e5d952960a5825e8760686500c65969a78fa50ff81"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249227.869387\tCWkW3yITrJlVVDaNe\t172.30.1.12\t55060\t172.30.1.254\t53\tudp\tdns\t0.002941\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:39.663Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":9452},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2cac4d3f9eb8b8b47d9fcc77d92f58e835442e323e7fb2c067e8bd2bdba10c5c"},"ecs":{"version":"1.6.0"},"message":"1765249237.969509\tCdTO4h3kpFDKphcJw9\t172.30.1.12\t54600\t172.30.1.254\t53\tudp\t34012\t0.002740\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:39.669Z","host":{"name":"f6b540842a86"},"log":{"offset":9845,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"38f52f61876c40028d041e2b5fabbae17bcfff320df5b14bf6ba468aafb97ad2"},"ecs":{"version":"1.6.0"},"message":"1765249236.973418\tCzITmJ24SDhhWbRfaa\t172.30.1.12\t39314\t172.30.1.254\t53\tudp\t34011\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t10.11.13.2\t240.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:39.669Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":9674},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"50ba4808b89b06d1cfa911e8fb98489363dbf3b7ba3c1df3d97fee448ce1247f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765249228.879476\tCndiKnEDppWlYG6V\t172.30.1.12\t57834\t172.30.1.254\t53\tudp\tdns\t0.002941\t44\t60\tSF\tT\tT\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:40.663Z","host":{"name":"f6b540842a86"},"log":{"offset":9580,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b20d1fb712aac42c9b26abb184c865c21f1e22012bca8b88d9ea6cd7a0c16919"},"ecs":{"version":"1.6.0"},"message":"1765249236.740258\tCBAc9v3Jti8VS8VT92\t172.30.1.35\t54468\t172.30.1.254\t53\tudp\t33555\t2.010738\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t615.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-09T03:00:40.669Z","host":{"name":"f6b540842a86"},"log":{"offset":10023,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}