Kafdrop

{"@version":"1","event":{"hash":"a8ff141b95e4b5edf095146e7f5e33b28fc5d3f5a3fcbc7583178b9f50f15e1e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338188.553892\tCpv48U1CoigL7xZuEf\tfe80::a629:9f54:45ee:d1d5\t143\tff02::16\t0\ticmp\t-\t7.991743\t80\t0\tOTH\tF\tF\t0\t-\t4\t304\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:18.278Z","host":{"name":"f6b540842a86"},"log":{"offset":680397,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"833d611c22c9af0ca98de9025256f0f164368e0039f4a181009ea074f6b19f2b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338236.558651\tC3v9LM2C3BX0lUPBp5\t172.30.1.35\t61650\t172.30.1.254\t53\tudp\tdns\t2.020467\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:18.278Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":680655},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4aac92ae12ddd0231ed596847ea3974bf1b7436bc148f816d585974fc261dbb1"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338246.552890\tCQTp7t4v1Q8F1Rv03a\t172.30.1.12\t53474\t8.8.8.8\t53\tudp\tdns\t0.027234\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:18.278Z","host":{"name":"f6b540842a86"},"log":{"offset":680531,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3254a4997458dcb43949741023414bee84046b1da613be712bf94149d6256dbe"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338246.587223\tCrjweE1oUGkZcLrIWb\t172.30.1.35\t58213\t8.8.8.8\t53\tudp\tdns\t0.029097\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:18.278Z","host":{"name":"f6b540842a86"},"log":{"offset":680786,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f7650c696aec1299e1bc475c3aff3c43fbf4bdef35758918aaf6f65ddca35735"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338196.870595\tCdamV11lD3U9iW7xC8\tfe80::c251:7eff:fe56:e095\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t76\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:19.278Z","host":{"name":"f6b540842a86"},"log":{"offset":680912,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3cea3c3a0e49d313e76e62f77b220ddb260819280c2633b49493b6a78813ec0f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338247.582521\tCU25ak3S0cDNP8f37j\t172.30.1.12\t47639\t8.8.8.8\t53\tudp\tdns\t0.028260\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:19.278Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":681037},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bca8cf22b6de565b769bdfabcdb05594a153dbee47d7cf0ad0a3ce5df48b0f44"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338190.262264\tC5pIm34vSNmZvR9Aq4\tfe80::68b5:14e3:6da1:5bd8\t143\tff02::16\t0\ticmp\t-\t7.510403\t80\t0\tOTH\tF\tF\t0\t-\t4\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.279Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":681285},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"130b43d1fe47462448c41ed21c800d947d7c1cf32c4995768c0efc12303684ff"},"ecs":{"version":"1.6.0"},"message":"1765338257.952885\tCni7oODIXpspDTfja\t172.30.1.12\t41183\t8.8.8.8\t53\tudp\t55909\t0.027947\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t175.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.799Z","host":{"name":"f6b540842a86"},"log":{"offset":679494,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c3ca2e863087880334bc46825dd94d620701493a456c8e366ec0d4dc481c0f5c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338197.861705\tCMty734XKxA8nxb7d3\tfe80::a272:2cff:fef5:f5fb\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t116\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.279Z","host":{"name":"f6b540842a86"},"log":{"offset":681545,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"903a78e4f81dda428f9666b9622ca2b84cbe831db222f198eb1a564369be2632"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338248.622583\tCr6ujB1U4kVMgHdie7\t172.30.1.12\t45396\t8.8.8.8\t53\tudp\tdns\t0.027264\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.279Z","host":{"name":"f6b540842a86"},"log":{"offset":681161,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7754d71675169a4955d0d69cae0e6aa2c7e438c4031a0ccdce68834e8492ef82"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338197.843313\tCBjRht4aiwiEoo0Ch8\tfe80::6263:4cff:febc:17c6\t143\tff02::16\t0\ticmp\t-\t-\t-\t-\tOTH\tF\tF\t0\t-\t1\t136\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.279Z","host":{"name":"f6b540842a86"},"log":{"offset":681419,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"63a43a0f4bf5cf164dad574814701e06dc030871939003351b33de993f2af6ff"},"ecs":{"version":"1.6.0"},"message":"1765338258.992655\tC1SATM2FVcDtjYt1C7\t172.30.1.12\t55733\t8.8.8.8\t53\tudp\t55910\t0.028600\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t15.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:20.799Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":679668},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2073420188bb5dab2eaaed734b0d0fcbe446172f5661a6485eee4c20c0997eeb"},"ecs":{"version":"1.6.0"},"message":"1765338260.032728\tCDIfgRM6SvtSW4bNk\t172.30.1.12\t51699\t8.8.8.8\t53\tudp\t55911\t0.027116\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t258.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:21.799Z","host":{"name":"f6b540842a86"},"log":{"offset":679842,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8ca1cd949e256950bf5b18a48c142ff1c91479e484f0e51c72abb6d5533ec958"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338253.161903\tCrDOoW2KSLKJjElx8k\t202.46.62.67\t14700\t172.30.1.2\t80\ttcp\thttp\t0.427474\t311\t510\tSF\tF\tT\t1\tShADadfTtGF\t7\t1006\t8\t1456\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:21.280Z","host":{"name":"f6b540842a86"},"log":{"offset":681671,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5b09a5606bd343fb9eaee5a57b549a83cd8fa26d54d9228a1fc3e3d3364ae7ce"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338249.652714\tC7bOFI2PPyJw8EjJu1\t172.30.1.12\t52944\t8.8.8.8\t53\tudp\tdns\t0.029071\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"offset":681933,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0542680ccab7891a0d7b641c16d8594300602a1c43fa24092235c5e4542304a7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338250.692552\tCrK3wk2zH5aVqKFCfk\t172.30.1.12\t56330\t8.8.8.8\t53\tudp\tdns\t0.029653\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"offset":682485,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"897e8e6022b198e47bbe0e4ae4006a70c0d004bbbf9661a161959446185f24ee"},"ecs":{"version":"1.6.0"},"message":"1765338261.062720\tC8LKH53KwBZg1TzCLf\t172.30.1.12\t48105\t8.8.8.8\t53\tudp\t55912\t0.029391\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t171.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.800Z","host":{"name":"f6b540842a86"},"log":{"offset":680016,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"daa68d0e92b2ac54802155f1f480a7b61bfb1ec01a3a27c9301ead1fedd327d4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338249.131089\tC0d9dO1QkMAEXL5wwl\t87.120.191.100\t45332\t172.30.1.2\t80\ttcp\thttp\t5.592513\t444\t483\tSF\tF\tT\t0\tShADadfF\t6\t764\t5\t751\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":682344},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9b1efb390b63123c697076ddcca4fea61fd22d565ed7df236403264e26ea4e6b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338253.595158\tC2m1Zi21qUow3Uuop6\t202.46.62.53\t15282\t172.30.1.2\t443\ttcp\tssl\t1.249107\t1082\t19037\tRSTO\tF\tT\t0\tShADadTtfR\t19\t2600\t22\t20264\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"offset":682057,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e2f6014e7951e6935ec672e3315b953f8e00e6ba940e7d1dc6f29c4a9fc638f3"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338137.299463\tCNnrakSPLyjg00nUa\tfe80::68b5:14e3:6da1:5bd8\t546\tff02::1:2\t547\tudp\t-\t63.022932\t602\t0\tS0\tF\tF\t0\tD\t7\t938\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"offset":682208,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"164c6f6eac0ccd12253a5ebaddb08be5b8b44ea4427584ee85deeb5b79204be7"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338255.424685\tCF1BFf3wh10Fr7ZQ6d\t172.30.1.63\t51436\t172.30.2.171\t5044\ttcp\t-\t-\t-\t-\tS0\tT\tT\t0\tS\t1\t60\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.281Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":681815},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"de0542580676a3671c8e82ecacc132a338452213b5fc073736ddbdeeba19cfb9"},"ecs":{"version":"1.6.0"},"message":"1765338261.560429\tCEcHROAbMVfVIP0tc\t172.30.1.35\t60351\t172.30.1.254\t53\tudp\t3626\t0.004867\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1535.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:22.800Z","host":{"name":"f6b540842a86"},"log":{"offset":680191,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ae95fe4cb4421b11ab47ca7338afaf7ea74e0285d74671d1ec654123c2e32c90"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338251.732787\tCf5zYHdtXSMH1kAgd\t172.30.1.12\t40324\t8.8.8.8\t53\tudp\tdns\t0.027507\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:23.282Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":682609},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6ab421509bf2c9547440b47f491a6480ad00077c85826a0ae345803266c04718"},"ecs":{"version":"1.6.0"},"message":"1765338262.102731\tCNCsZC4BkXl2RMhxu7\t172.30.1.12\t59739\t8.8.8.8\t53\tudp\t55913\t0.027933\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t207.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:23.801Z","host":{"name":"f6b540842a86"},"log":{"offset":680363,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"005fda1d9b1776c5892f9e175603bca2c9bb1ffcc3d15b97e42faec8733dcce2"},"ecs":{"version":"1.6.0"},"message":"1765338263.132819\tC1iEMp1bxOjm49PlDe\t172.30.1.12\t55256\t8.8.8.8\t53\tudp\t55914\t0.026803\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t169.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:24.801Z","host":{"name":"f6b540842a86"},"log":{"offset":680538,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9083904ffa7d621a17e710fecc788581a2e844f037f7dd4fa9afa0ca133b502a"},"ecs":{"version":"1.6.0"},"message":"1765338253.681421\tC2m1Zi21qUow3Uuop6\t202.46.62.53\t15282\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tFJiGp34Vh1339xYWeb,FdykUs2m4CCucGux06\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:24.854Z","host":{"name":"f6b540842a86"},"log":{"offset":44188,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b03bd923b8708b09bb3ad7e57064ba522800c4ab0d0fe5f704b196fc487c6710"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338251.558885\tC29Vf13JNNPhn0Gr2d\t172.30.1.35\t57549\t172.30.1.254\t53\tudp\tdns\t0.004525\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:24.288Z","host":{"name":"f6b540842a86"},"log":{"offset":682732,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5b3166bd8f949c51231d289f01299c6e5a869120e5b81e8aed2c77d8aa410f95"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338241.547648\tCZAJ7k1yf6ASf3ygA1\t172.30.1.35\t64392\t172.30.1.254\t53\tudp\tdns\t2.021435\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:24.288Z","host":{"name":"f6b540842a86"},"log":{"offset":682863,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0a97511067a55aaded492192928791cbb1fd4643c0971786c0b74d1eeccca78f"},"ecs":{"version":"1.6.0"},"message":"1765338253.689924\tFJiGp34Vh1339xYWeb\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:24.782Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/x509.log"},"offset":37291},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cb5f2d1339707bc5c2b86c4814072df6ccc655ef11cffdf7f3bde8a8b56509b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338253.792595\tCvqEHo2bRWk99lSwJ1\t172.30.1.12\t59527\t8.8.8.8\t53\tudp\tdns\t0.028697\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:25.290Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":683118},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b115fcce13435545b87fb4fcefe2cb7b585951d85deb4e4b28102d0a54bac91c"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338252.764792\tCvFvDT1AN98ceqzMmh\t172.30.1.12\t55254\t8.8.8.8\t53\tudp\tdns\t0.025465\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:25.289Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":682994},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f3fcaa4f24a8e0e019de072ab6c1ff2f50994111051da58bd3d967743b96c25b"},"ecs":{"version":"1.6.0"},"message":"1765338264.162707\tCJsEmLctYjqfwea6e\t172.30.1.12\t36957\t8.8.8.8\t53\tudp\t55915\t0.026902\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t168.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:25.801Z","host":{"name":"f6b540842a86"},"log":{"offset":680713,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ddcb74c7e91a81ac30f18404d39cd4e2e8d31bac1a55ee3d984d18d425a92786"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338259.610175\tCmPlSY3otjAfFJVww3\t172.30.1.2\t52412\t172.30.4.139\t1514\ttcp\t-\t2.998992\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:26.290Z","host":{"name":"f6b540842a86"},"log":{"offset":683242,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c1de48a785cf03156722d93b2079188ba5cdaffdd0184073ade33f38ffa9fbf8"},"ecs":{"version":"1.6.0"},"message":"1765338265.193412\tC4ikld2pxf33bzAcSi\t172.30.1.12\t41135\t8.8.8.8\t53\tudp\t55916\t0.029523\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t9.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:26.802Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":680887},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c35657a143ed1405ee79e3636797ab2fa3a76600b52a5dfd4f7fe6ed989e5964"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338255.862752\tCS9HJf1ElZjPvVRChe\t172.30.1.12\t57985\t8.8.8.8\t53\tudp\tdns\t0.027387\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:27.290Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":683491},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f3b0fd6982342abe2900eec49d8c215cf7575c7333357bf74ba414e36949cef4"},"ecs":{"version":"1.6.0"},"message":"1765338266.233350\tCn06hn4qyMj3SMv70d\t172.30.1.12\t41457\t8.8.8.8\t53\tudp\t55917\t0.029334\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t8.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:27.802Z","host":{"name":"f6b540842a86"},"log":{"offset":681234,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f1072457fbf1366488b6b5344e1fa3cebaa2d03a2cfc3aa5618a9835711c39d3"},"ecs":{"version":"1.6.0"},"message":"1765338266.556775\tCB0Q6p4siJRl1k3U8g\t172.30.1.35\t64723\t172.30.1.254\t53\tudp\t24337\t0.024913\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1554.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:27.802Z","host":{"name":"f6b540842a86"},"log":{"offset":681060,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e2d901635499c27823fe5b56aecd6514739834877ee0c162f913effa9a397454"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338254.832645\tCe2M414RYdZ9zGkAgi\t172.30.1.12\t44636\t8.8.8.8\t53\tudp\tdns\t0.027016\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:27.290Z","host":{"name":"f6b540842a86"},"log":{"offset":683367,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3f2a673add8cae6266f330820185d7c65b362718c1d819dade82e4d6b902c9bc"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338256.558560\tCrek1g2CRpWG40hqae\t172.30.1.35\t52995\t172.30.1.254\t53\tudp\tdns\t0.005089\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:28.291Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":683615},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5576a36a64b0de9729c54984db57412cf38c7f2dce1d3c1ee58922a8d5beff0a"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338246.548188\tCS64mT28SYipAPOD92\t172.30.1.35\t58213\t172.30.1.254\t53\tudp\tdns\t2.020906\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:28.291Z","host":{"name":"f6b540842a86"},"log":{"offset":683870,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"24f54f4d2ac4a143a1bc9dd4b547370caa9846fc4a92d1c4866a7bebafb36d48"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338255.891824\tCEeNBB3PvUHwGPUeUl\t172.30.1.12\t58990\t8.8.8.8\t53\tudp\tdns\t0.027935\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:28.291Z","host":{"name":"f6b540842a86"},"log":{"offset":683746,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"908359dcfc5c180f46f2b4b9ed2077505fdb0cd9ec2c1193a96813b89c91a61e"},"ecs":{"version":"1.6.0"},"message":"1765338267.272732\tCzpIOl35oJwItKzBzi\t172.30.1.12\t55640\t8.8.8.8\t53\tudp\t55918\t0.028554\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t7.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:28.802Z","host":{"name":"f6b540842a86"},"log":{"offset":681407,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"aae1cbb5737d4cf4ac112d14846aa4fa5847d21832ce78495862c817de1db0cc"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338262.610163\tC2x6dz3K2ONWJcoimb\t172.30.1.2\t58690\t172.30.4.139\t1515\ttcp\t-\t2.999019\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:29.291Z","host":{"name":"f6b540842a86"},"log":{"offset":684125,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4d9948a15a5eb01c97e61d4cc21b5f225a57d3f007d09f546c7371c18c666fea"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338256.922613\tC0mPHx1wpAA2DcK2K6\t172.30.1.12\t52726\t8.8.8.8\t53\tudp\tdns\t0.026848\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:29.291Z","host":{"name":"f6b540842a86"},"log":{"offset":684001,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b811925f42fca5d651dc799212897901214bd9ba4aaf55b7e0b6b8e63eb531bd"},"ecs":{"version":"1.6.0"},"message":"1765338268.312736\tCGxWNWWgWuYjymovc\t172.30.1.12\t33432\t8.8.8.8\t53\tudp\t55919\t0.027747\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t250.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:29.803Z","host":{"name":"f6b540842a86"},"log":{"offset":681580,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"1316555b82c489de0684637a572999ac0564a1a9596252db33f2a99c0c8c9797"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338208.141113\tCriUd22UenxPTJduo2\t172.30.1.35\t55116\t8.8.4.4\t443\tudp\t-\t0.064046\t4498\t6493\tSF\tT\tF\t0\tDd\t11\t4806\t14\t6885\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:30.299Z","host":{"name":"f6b540842a86"},"log":{"offset":684250,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3252300ef3ae68f1906a99ead440607c4535ef7c843b988a23a6f3369abd480f"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338257.952885\tCni7oODIXpspDTfja\t172.30.1.12\t41183\t8.8.8.8\t53\tudp\tdns\t0.027947\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:30.299Z","host":{"name":"f6b540842a86"},"log":{"offset":684383,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7a62930cbd1869da4626b742e03ada93332c2346c5b60d79d433174308250670"},"ecs":{"version":"1.6.0"},"message":"1765338269.347755\tCz13Df4IUVFN1hyxmi\t172.30.1.12\t59836\t8.8.8.8\t53\tudp\t55920\t0.027692\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t163.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:30.804Z","host":{"name":"f6b540842a86"},"log":{"offset":681754,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2c2bd31644dca3bfb6a761ae6f16774c04a7ff2dc5e79d53dd131570ceeb9334"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338258.992655\tC1SATM2FVcDtjYt1C7\t172.30.1.12\t55733\t8.8.8.8\t53\tudp\tdns\t0.028600\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:31.300Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":684506},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2eeba5d37fa8ed8c1e89a4452ff638d96219d7eb8e9b806f41dc5b1118f0e802"},"ecs":{"version":"1.6.0"},"message":"1765338270.385469\tCCvY2k1wXqx5Shmsg8\t172.30.1.12\t33624\t8.8.8.8\t53\tudp\t55921\t0.024468\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t199.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:31.804Z","host":{"name":"f6b540842a86"},"log":{"offset":681929,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8c27786813505023c0b9889db16d4962fb374540fcfecbea92b32e84ace5f748"},"ecs":{"version":"1.6.0"},"message":"1765338271.591012\tClK7uD11rHQlIUhzyd\t172.30.1.35\t53848\t8.8.8.8\t53\tudp\t4341\t0.027143\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2098.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:32.805Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":682104},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cf381bbe301a1312fe5840618633be598ba2684c5d8a15b998da0976a2813c6e"},"ecs":{"version":"1.6.0"},"message":"1765338271.412806\tCiyHia2ILoSSdzauaa\t172.30.1.12\t33544\t8.8.8.8\t53\tudp\t55922\t0.027817\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t247.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:32.805Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":682272},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"06d15764253ba909c48b87e8077d18727e157f7b2b6d4ec29355057923d9a640"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338260.032728\tCDIfgRM6SvtSW4bNk\t172.30.1.12\t51699\t8.8.8.8\t53\tudp\tdns\t0.027116\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:32.300Z","host":{"name":"f6b540842a86"},"log":{"offset":684630,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7ef2a110a4e9b1fdbacc94aa4e4a9557c1df736793297bffa8fb89067484df40"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338261.560429\tCEcHROAbMVfVIP0tc\t172.30.1.35\t60351\t172.30.1.254\t53\tudp\tdns\t0.004867\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:33.301Z","host":{"name":"f6b540842a86"},"log":{"offset":684753,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d6cb08a625d4286e3750ce54777c5eb96afa0685cf2b8335b2cdb8f9e960c6b0"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338261.062720\tC8LKH53KwBZg1TzCLf\t172.30.1.12\t48105\t8.8.8.8\t53\tudp\tdns\t0.029391\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:33.301Z","host":{"name":"f6b540842a86"},"log":{"offset":684883,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"45f1968ed094c24c9451ae00026aca3bf60b3254b3d6608211964fcb7cff8d1f"},"ecs":{"version":"1.6.0"},"message":"1765338272.442840\tCS0caZ3GIgB1d8U512\t172.30.1.12\t51671\t8.8.8.8\t53\tudp\t55923\t0.027081\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t2.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:33.806Z","host":{"name":"f6b540842a86"},"log":{"offset":682447,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a4e3e7925a5954aeb84ac901130e18feb94b59847dcc39f3e9040d13705d15d2"},"ecs":{"version":"1.6.0"},"message":"1765338271.549295\tC3JwaU251kh8DL1Mi1\t172.30.1.35\t53848\t172.30.1.254\t53\tudp\t4341\t0.890133\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1524.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:33.806Z","host":{"name":"f6b540842a86"},"log":{"offset":682620,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d9d2852a1d7a4915887369c7c7e07617e50d29b2774b0fcc3fdc05e9ae71e71e"},"ecs":{"version":"1.6.0"},"message":"1765338273.472832\tCP0vSW1S3wqidn3cbf\t172.30.1.12\t59815\t8.8.8.8\t53\tudp\t55924\t0.027584\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t1.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:34.806Z","host":{"name":"f6b540842a86"},"log":{"offset":682793,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ea884f48cb6cbbd1d05da48a5139000c41256e5229d7435375e9f7fd7cf04424"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338262.102731\tCNCsZC4BkXl2RMhxu7\t172.30.1.12\t59739\t8.8.8.8\t53\tudp\tdns\t0.027933\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:34.302Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":685007},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e46d6864fe066ce12f2ea0cf7ae68bf5c0e74d0b829f7b1bd42aef0b44718673"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338263.132819\tC1iEMp1bxOjm49PlDe\t172.30.1.12\t55256\t8.8.8.8\t53\tudp\tdns\t0.026803\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:35.305Z","host":{"name":"f6b540842a86"},"log":{"offset":685131,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7c5ef872d322a4f87eb448c9f2c4d8e6d3eab4c281c5ff639a1e6eb158f3c600"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338268.274240\tCSqq4F2TusNILG27bg\t10.10.10.1\t35866\t10.10.10.202\t8000\ttcp\t-\t0.165118\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:35.306Z","host":{"name":"f6b540842a86"},"log":{"offset":685255,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"875db2300eb9b4a129031ee5bc429828fe34f7a43ba7a8c48533326ad6852ae9"},"ecs":{"version":"1.6.0"},"message":"1765338274.503026\tCGO8qr3sSCxkAvYx3j\t172.30.1.12\t47659\t8.8.8.8\t53\tudp\t55925\t0.027828\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t195.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:35.806Z","host":{"name":"f6b540842a86"},"log":{"offset":682966,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"673eb58460a453c514d0dd490114a9b213d8f57a863fdc58483b3f877f052deb"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338264.162707\tCJsEmLctYjqfwea6e\t172.30.1.12\t36957\t8.8.8.8\t53\tudp\tdns\t0.026902\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:36.307Z","host":{"name":"f6b540842a86"},"log":{"offset":685384,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d9f632329f3c3949c8eb32da95c01afde1a7b17fea067af0fa65c9ad68cf40ea"},"ecs":{"version":"1.6.0"},"message":"1765338275.542894\tCMMwhp2ZeYU0mQTUn8\t172.30.1.12\t48241\t8.8.8.8\t53\tudp\t55926\t0.028443\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t157.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:36.807Z","host":{"name":"f6b540842a86"},"log":{"offset":683141,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2718441dfa47d6c2e7d0f399006c69fc8ea1d448ad3f8a9583904f94d1a6cf7f"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338270.049673\tCIjAaz4NA9FPYjCzg9\t172.30.1.2\t60088\t172.30.4.136\t5044\ttcp\t-\t2.999440\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.308Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":685507},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5fb8677dab478cc91d9c0f4ee9852c42b524b48fc0417dba9db5964c2e0b5b78"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338270.631939\tCtGAnc194iUWl9iuth\t172.30.1.35\t52203\t172.30.2.17\t7680\ttcp\t-\t0.002865\t75\t0\tSF\tT\tT\t1\tShADgFfa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.308Z","host":{"name":"f6b540842a86"},"log":{"offset":685632,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"00cd69dcf125fec9aae0b403a51f6602baeee258b1ae5a03af4972fa6381e93c"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338265.193412\tC4ikld2pxf33bzAcSi\t172.30.1.12\t41135\t8.8.8.8\t53\tudp\tdns\t0.029523\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.308Z","host":{"name":"f6b540842a86"},"log":{"offset":685767,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"42cbf2f698dac775423d7a84094ad9b9ee87f9b37abcf91a4da5ba5d60f9bc80"},"ecs":{"version":"1.6.0"},"message":"1765338276.583126\tCV1wqu1phDatW7VaH\t172.30.1.12\t45368\t8.8.8.8\t53\tudp\t55927\t0.029100\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t242.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.807Z","host":{"name":"f6b540842a86"},"log":{"offset":683316,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"aa90898f82f21762f96c2d26e7692f208d6335af48defa2f2adcb7c3217f1c42"},"ecs":{"version":"1.6.0"},"message":"1765338276.593606\tCEtpWD32zhFjO5LNm9\t172.30.1.35\t63625\t8.8.8.8\t53\tudp\t18169\t0.026734\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t585.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.807Z","host":{"name":"f6b540842a86"},"log":{"offset":683490,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4ecdc1a189776105483cac566f55a0ddea170fdcf8d8334dabfb7a3d42ab074e"},"ecs":{"version":"1.6.0"},"message":"1765338276.554949\tC92tST2Ag1tqj7afY9\t172.30.1.35\t63625\t172.30.1.254\t53\tudp\t18169\t0.070637\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1520.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:37.807Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":683658},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d13ce619b804d21292336b3e7596b2c600891215d9db14b05e1d053c74abb2d6"},"ecs":{"version":"1.6.0"},"message":"1765338277.677925\tCNAFt3399zJyMGpNTj\t172.30.1.12\t48396\t8.8.8.8\t53\tudp\t55928\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t155.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:38.808Z","host":{"name":"f6b540842a86"},"log":{"offset":683832,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0d48795bcffb60318fd72284372c2011c4e1403a764ed8aadf6a27ac0181ca40"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338266.233350\tCn06hn4qyMj3SMv70d\t172.30.1.12\t41457\t8.8.8.8\t53\tudp\tdns\t0.029334\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:38.308Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":685891},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"705323c369ec93c9a3e30a2e9c43c3e1de8814b33b81a15ce3607fca20e371e7"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338266.556775\tCB0Q6p4siJRl1k3U8g\t172.30.1.35\t64723\t172.30.1.254\t53\tudp\tdns\t0.024913\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:38.309Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":686015},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ff731c908ba207618716ea1de872f73262f2df5ca3db33239416abe973c8da7c"},"ecs":{"version":"1.6.0"},"message":"1765338278.652804\tC7kdEk1h9dEadOvgoe\t172.30.1.12\t54966\t8.8.8.8\t53\tudp\t55929\t0.027257\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t296.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:39.808Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":684000},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c25ddc74d62d7a65f8553852c79720853dbfc7ebf97a2c373284195d68bbdf56"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338268.312736\tCGxWNWWgWuYjymovc\t172.30.1.12\t33432\t8.8.8.8\t53\tudp\tdns\t0.027747\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:40.309Z","host":{"name":"f6b540842a86"},"log":{"offset":686403,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0c1bfaf13147af194d4084e3ff86a58bd7a6baab80db2ec3a7d20da7dc6ac18c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338267.272732\tCzpIOl35oJwItKzBzi\t172.30.1.12\t55640\t8.8.8.8\t53\tudp\tdns\t0.028554\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:39.309Z","host":{"name":"f6b540842a86"},"log":{"offset":686146,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5098967ce97068ee54a533a8c37ed6c3420d292f8fd991e47fa9a15d953fa51c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338272.438570\tC2EFNuowtiEFXyNfd\t172.30.2.16\t52669\t172.30.1.35\t7680\ttcp\t-\t0.002379\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:39.309Z","host":{"name":"f6b540842a86"},"log":{"offset":686270,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a5d96c5d02b4a64e7a300e2f1520fe7e560f190310b019b44dc6762d73458c79"},"ecs":{"version":"1.6.0"},"message":"1765338279.699428\tCkF96Q3TXDI4SUipog\t172.30.1.12\t35296\t8.8.8.8\t53\tudp\t55930\t0.010818\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t239.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:40.808Z","host":{"name":"f6b540842a86"},"log":{"offset":684175,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ed4dbc18e58ad24be40e35f19a765207ab8cc594467566bcd9a3d938bec01836"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338269.347755\tCz13Df4IUVFN1hyxmi\t172.30.1.12\t59836\t8.8.8.8\t53\tudp\tdns\t0.027692\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:41.310Z","host":{"name":"f6b540842a86"},"log":{"offset":686526,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f4a11480469d6ceef930c5897c216b00322e2b58c61cca8f93919f03028b38e8"},"ecs":{"version":"1.6.0"},"message":"1765338280.712848\tC83acVYTmE1sKnt89\t172.30.1.12\t42759\t8.8.8.8\t53\tudp\t55931\t0.027465\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t152.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:41.809Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":684350},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ec3dee797d440d5c26140839ae80557c59a69f85c6492eddac2047291fc67f9a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765338275.610489\tC2LECE2OzWoZJ0z7ol\t172.30.1.2\t52418\t172.30.4.139\t1514\ttcp\t-\t2.998627\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:42.314Z","host":{"name":"f6b540842a86"},"log":{"offset":686774,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ddc4d96180da5134dc8a5dde1b28db1f603993f5661f7ca9752cd7546bd19a93"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338270.385469\tCCvY2k1wXqx5Shmsg8\t172.30.1.12\t33624\t8.8.8.8\t53\tudp\tdns\t0.024468\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:42.313Z","host":{"name":"f6b540842a86"},"log":{"offset":686650,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0e6a47df90bd644afddfb448f8b48c0779fdf22a371cfe79ae96cde0de1a9899"},"ecs":{"version":"1.6.0"},"message":"1765338281.553638\tC52A7r3J6A5EHY6cMa\t172.30.1.35\t50340\t172.30.1.254\t53\tudp\t34566\t0.004789\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1515.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:42.809Z","host":{"name":"f6b540842a86"},"log":{"offset":684699,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bd0ce6fb009e6320b65c1f0a12909176db72e218c653753491ee7dab39ffa9fb"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338271.412806\tCiyHia2ILoSSdzauaa\t172.30.1.12\t33544\t8.8.8.8\t53\tudp\tdns\t0.027817\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:43.314Z","host":{"name":"f6b540842a86"},"log":{"offset":687025,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"453ed803bd11720e3440ec4cdc52551fa2d769dbc010e24e6fb3354b5dca56b4"},"ecs":{"version":"1.6.0"},"message":"1765338281.742887\tCEaJr22UKMODVzbQq5\t172.30.1.12\t34945\t8.8.8.8\t53\tudp\t55932\t0.030251\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t237.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:42.809Z","host":{"name":"f6b540842a86"},"log":{"offset":684524,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8c6b16c4d5ac36af0d3b3693f713cdf6e3819184f89e4532f12f22cf55515d86"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765338271.549295\tC3JwaU251kh8DL1Mi1\t172.30.1.35\t53848\t172.30.1.254\t53\tudp\tdns\t0.890133\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:43.314Z","host":{"name":"f6b540842a86"},"log":{"offset":687149,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f7ed6883b327bcb0cae649cdb910137685e2d7c253eb388ea4f2630b164f60ea"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338271.591012\tClK7uD11rHQlIUhzyd\t172.30.1.35\t53848\t8.8.8.8\t53\tudp\tdns\t0.027143\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:43.314Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":686899},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"478ef0b4b6d32528717eeabb3c21372eba1079a9aa0a19438b4beaa2abdc30d2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338272.442840\tCS0caZ3GIgB1d8U512\t172.30.1.12\t51671\t8.8.8.8\t53\tudp\tdns\t0.027081\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:44.314Z","host":{"name":"f6b540842a86"},"log":{"offset":687280,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bdd741b80034afc3ad77e752123fb0ae10a0fb4aa401f875af37c4cfac7864e7"},"ecs":{"version":"1.6.0"},"message":"1765338283.822908\tCA1EV2hf1SCJ7X7Jl\t172.30.1.12\t43796\t8.8.8.8\t53\tudp\t55934\t0.028108\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t291.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:44.810Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":685048},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f21339100249e5eb7161c469cbc768306b80a05370007187196fe6219dbb216e"},"ecs":{"version":"1.6.0"},"message":"1765338282.783227\tCsLcuD1wAsjyznAHf4\t172.30.1.12\t33190\t8.8.8.8\t53\tudp\t55933\t0.028047\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t150.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:43.810Z","host":{"name":"f6b540842a86"},"log":{"offset":684873,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ebf5cfc20ed36fcb6c164aebcee5b90b285ef6ab45be5806759bef5d01f8136b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338273.472832\tCP0vSW1S3wqidn3cbf\t172.30.1.12\t59815\t8.8.8.8\t53\tudp\tdns\t0.027584\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:45.315Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":687404},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e78628d9a23f2051be62557d38b3681a447dd27e9b5884361ae7438c57cb14e1"},"ecs":{"version":"1.6.0"},"message":"1765338284.852862\tCe4Esb1g3NRshfe01b\t172.30.1.12\t33746\t8.8.8.8\t53\tudp\t55935\t0.026584\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t234.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:44:45.810Z","host":{"name":"f6b540842a86"},"log":{"offset":685222,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a1717f859eac853ce87330236668062ab14e36b54b0a66aa2cc4be9d25cb0699"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338527.935062\tCD8Zlp2jEbY9ZDxke\t129.45.84.93\t33425\t172.30.1.2\t80\ttcp\t-\t0.316474\t0\t0\tRSTO\tF\tT\t0\tShR\t2\t84\t1\t44\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:55.519Z","host":{"name":"f6b540842a86"},"log":{"offset":746791,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ff4815a975a0b327c0d1c379883957c951483d53c6f61d5a5cf0d628c0c237b7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338527.461246\tC0dVrM3SYZTFcidr11\t172.30.1.12\t40937\t61.90.207.93\t9090\ttcp\t-\t2.027208\t2095\t1274\tSF\tT\tF\t0\tShADadFf\t9\t2571\t5\t1542\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:55.519Z","host":{"name":"f6b540842a86"},"log":{"offset":747168,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5bd765941dfabe43185d186a882c5e86f1b10333e02dc35af34db660edfe512d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338528.654860\tCgsfqW8nmHyUwzzl2\t10.10.10.1\t35894\t10.10.10.202\t8000\ttcp\t-\t0.012568\t36\t0\tSH\tT\tT\t0\tSADF\t5\t304\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:55.519Z","host":{"name":"f6b540842a86"},"log":{"offset":746917,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"89f67d42b50adeb110230a03f1db263231e7f3d2e5e2d63294925f11f6c2c075"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338524.215174\tC8hbvjj5aVcvESLAg\t172.30.1.12\t51569\t8.8.8.8\t53\tudp\tdns\t0.027593\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:55.519Z","host":{"name":"f6b540842a86"},"log":{"offset":747045,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"777846b4145aea5fb038bde8b4a4a46118ae9271711786dab5fea4fa2d4600b0"},"ecs":{"version":"1.6.0"},"message":"1765338531.560054\tCs9EzGYD8grXMC2O5\t172.30.1.35\t58295\t172.30.1.254\t53\tudp\t5835\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1265.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:56.046Z","host":{"name":"f6b540842a86"},"log":{"offset":743037,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"134e76ec047ad585ca7665577c3bdedfe590a520c117380991017d50c39b1832"},"ecs":{"version":"1.6.0"},"message":"1765338535.015685\tC5Ni8t3aneRW33dni9\t172.30.1.12\t38344\t8.8.8.8\t53\tudp\t56179\t0.028693\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t262.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:56.046Z","host":{"name":"f6b540842a86"},"log":{"offset":743202,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c8fc494e647295545ceb5fc3d3e5547de791b7b5deb96374bfa624f33dd1a78d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338525.245206\tC9aeDn4mfKhFapm3Zj\t172.30.1.12\t49927\t8.8.8.8\t53\tudp\tdns\t0.027906\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:56.520Z","host":{"name":"f6b540842a86"},"log":{"offset":747449,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"08db0d9756f6add2f87963b8e9329067403b8012753d8ce99684c1bda143851a"},"ecs":{"version":"1.6.0"},"message":"1765338536.055285\tCA2s4r28qmj68jbKYk\t172.30.1.12\t53747\t8.8.8.8\t53\tudp\t56180\t0.027081\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t38.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:48:57.046Z","host":{"name":"f6b540842a86"},"log":{"offset":743377,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}