Kafdrop

{"@version":"1","event":{"hash":"84307c564c7d6c13e8324288794b780c5f8259f17c63a37bc1478158337d92e1"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337399.414219\tCXlS3G27x8sQ7mPB32\t172.30.1.12\t48198\t8.8.8.8\t53\tudp\tdns\t0.027292\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:11.514Z","host":{"name":"f6b540842a86"},"log":{"offset":468952,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"65e485cde8900a2ca8cadcacebfb511072903a0c338eadecfb342eedfd9d86c6"},"ecs":{"version":"1.6.0"},"message":"1765337409.774328\tCfUjVK2ierob4SZLPk\t172.30.1.12\t54633\t8.8.8.8\t53\tudp\t55078\t0.026719\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t209.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:11.079Z","host":{"name":"f6b540842a86"},"log":{"offset":472926,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4ad5e13ce3b7fe0f2fe693ebd4fca8628c9c7a93ace581f41c7ad5b16f434745"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337400.444359\tCP13qw4271VAQAsld\t172.30.1.12\t33040\t8.8.8.8\t53\tudp\tdns\t0.027164\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:11.514Z","host":{"name":"f6b540842a86"},"log":{"offset":469201,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8a72cd75ce14a51ee30b61c623964b9b6c930dba7570893e0db1a56a8e59e28c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337404.568584\tCrgF4A2mGfYNT44zNk\t172.30.1.2\t52228\t172.30.4.139\t1514\ttcp\t-\t2.990482\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:11.514Z","host":{"name":"f6b540842a86"},"log":{"offset":469076,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ef3692912275fb9b2e5551984773ff569cd3424c5884a3dffa2e788dba8e85a6"},"ecs":{"version":"1.6.0"},"message":"1765337410.825016\tCRfeLr1CfzU5XYdrx7\t172.30.1.12\t42061\t8.8.8.8\t53\tudp\t55079\t0.006769\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t122.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:12.079Z","host":{"name":"f6b540842a86"},"log":{"offset":473101,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"575d93bc224c10dac9446c06dc1dcd8799538ace25395f924ecf408dedb841a0"},"ecs":{"version":"1.6.0"},"message":"1765337402.917477\tCTEOrE1IoYiDqeYlpc\t202.46.62.67\t36857\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=aclr&smid=19524&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t266\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFUtFJ41yPEkn7Tmbi6\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:12.709Z","host":{"name":"f6b540842a86"},"log":{"offset":19220,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6b96b973109e1f5954cc6efede56858a79702855d40a5e4b67851f43d911999b"},"ecs":{"version":"1.6.0"},"message":"1765337411.588746\tCjGTsV2gqkDy50V2D1\t172.30.1.35\t60231\t172.30.1.254\t53\tudp\t41\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2385.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:13.081Z","host":{"name":"f6b540842a86"},"log":{"offset":473276,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a1aa830a491f497f747fcd8e2fec8dd6d2011f4e96262f919a57ccc455c7d2cd"},"ecs":{"version":"1.6.0"},"message":"1765337411.834270\tCAQG5aKFwAuxxUDo9\t172.30.1.12\t42499\t8.8.8.8\t53\tudp\t55080\t0.029281\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t207.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:13.081Z","host":{"name":"f6b540842a86"},"log":{"offset":473440,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d6746eb3dd7ba939c16bdfdea8b05b5d768352187b63e43d20f78983a7061f8b"},"ecs":{"version":"1.6.0"},"message":"1765337412.874636\tCdimwB1YUahU36dOul\t172.30.1.12\t51161\t8.8.8.8\t53\tudp\t55081\t0.026774\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t206.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:14.082Z","host":{"name":"f6b540842a86"},"log":{"offset":473614,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5b24374b303013981e2d3b6370dd5eb877e17152f976c73ade7fa38fe13c2774"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337401.474227\tC85vVr1bHklruwLMik\t172.30.1.12\t54537\t8.8.8.8\t53\tudp\tdns\t0.028464\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:14.515Z","host":{"name":"f6b540842a86"},"log":{"offset":469324,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c115cd0114925c8ae800e2f47ac8c356c0b90b2eba40be8c03c9f4c6efe8059e"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337401.582390\tCrzKXE2fUglE4VVUL6\t172.30.1.35\t63215\t8.8.8.8\t53\tudp\tdns\t0.029523\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:14.515Z","host":{"name":"f6b540842a86"},"log":{"offset":469448,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"691017300b34f9fbe74e975ae1dc5b39ccbb810086ed5d0b3aa6b80203f83054"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337402.514229\tCFqkNo2R1UdjIf85dj\t172.30.1.12\t50470\t8.8.8.8\t53\tudp\tdns\t0.028263\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:14.515Z","host":{"name":"f6b540842a86"},"log":{"offset":469574,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ba720f5158e10e587adb41461ceddd054e2187683cc82a5002bd5dc249b60703"},"ecs":{"version":"1.6.0"},"message":"1765337413.904424\tCpZi0L3cGyvaWUwDtl\t172.30.1.12\t49561\t8.8.8.8\t53\tudp\t55082\t0.028758\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t205.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:15.082Z","host":{"name":"f6b540842a86"},"log":{"offset":473789,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8dd149a8a4d1615b8713fa4d638d72c7e2d07dcba032b43ee511dca73e537ad4"},"ecs":{"version":"1.6.0"},"message":"1765337415.026706\tCUgz5yZnPcRYEbwl\t172.30.1.12\t46228\t8.8.8.8\t53\tudp\t55083\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t204.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:16.082Z","host":{"name":"f6b540842a86"},"log":{"offset":473964,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"8a5dda6ff29629a595dd9f1ec7d8ede6da2c6b9ab5d6f41244b0e21e674f2c69"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337403.564364\tCThHh11iOxWBwT7BEh\t172.30.1.12\t33253\t8.8.8.8\t53\tudp\tdns\t0.027577\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:15.515Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":469698},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6a8f664a8ae5c23cc3acbf1b752e542c52b45dd63329fbfd755040534d493590"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337404.594365\tCgXcs4Rp8ZCQgsof8\t172.30.1.12\t52702\t8.8.8.8\t53\tudp\tdns\t0.027470\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:16.516Z","host":{"name":"f6b540842a86"},"log":{"offset":469822,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a303c3230052d8fd9be0b50383751856a4a09af9a993739bc5a165a2a91f42a9"},"ecs":{"version":"1.6.0"},"message":"1765337415.984491\tCYTSiRj9ER2LI1jck\t172.30.1.12\t60804\t8.8.8.8\t53\tudp\t55084\t0.029131\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t203.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.083Z","host":{"name":"f6b540842a86"},"log":{"offset":474130,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"12e616c200735681d685965b75a8aa40f26e9de4aa3ad9358c945cac6218916b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337405.624297\tCLWRwg1AL0NLknYhyh\t172.30.1.12\t48487\t8.8.8.8\t53\tudp\tdns\t0.028774\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:16.516Z","host":{"name":"f6b540842a86"},"log":{"offset":469945,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"16c54f0e8291cec35e3fb56ae9dfa928d834363ca5cec31cc7137334f2cd4297"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337406.541117\tCk2G102UBbxKCfPQM9\t172.30.1.35\t60337\t172.30.1.254\t53\tudp\tdns\t1.059613\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.518Z","host":{"name":"f6b540842a86"},"log":{"offset":470311,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"98ac90109b8b50cf56d9535a5f206537ffabc280f53ae52b01719e77c324ca01"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337406.581155\tCljK7LOalk7SpnwN1\t172.30.1.35\t60337\t8.8.8.8\t53\tudp\tdns\t0.028409\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.518Z","host":{"name":"f6b540842a86"},"log":{"offset":470442,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b86152c9499193533660891f05cb0ccf8d0248d2aa94369be6d1f6372b61a043"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337355.278571\tCghfh12Apu9NGeNAo8\t172.30.1.4\t52072\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.517Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":470069},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"aa5acbf44ad10188d0dfaa9401266385c3d6c5fe462190760e065105980d6b69"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337355.278613\tCObfxm13dKHaVJv1r4\t10.10.10.1\t55086\t255.255.255.255\t7989\tudp\t-\t-\t-\t-\tS0\tT\tF\t0\tD\t1\t176\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.518Z","host":{"name":"f6b540842a86"},"log":{"offset":470190,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"019005e41ea0a019ff4e74388b14e2df3ff48e7b62e70ca244cbb538cd9b13ca"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337356.655758\tCBhkqF4Sg2164HR6id\t172.30.1.14\t3072\t239.255.255.250\t1900\tudp\t-\t0.009200\t2390\t0\tS0\tT\tF\t0\tD\t8\t2614\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:17.518Z","host":{"name":"f6b540842a86"},"log":{"offset":470567,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"53d015906f2022c82fcdc462ec74813e4036430cd513ff86519961f566ae96a4"},"ecs":{"version":"1.6.0"},"message":"1765337416.539071\tCoy6Ny2TpXzseS7Sf7\t172.30.1.35\t51436\t172.30.1.254\t53\tudp\t25643\t0.005013\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2380.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:18.083Z","host":{"name":"f6b540842a86"},"log":{"offset":474304,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fc698533015ffc8bd27d8a21ec58325abc3014c8e245b08fb6857d6ce665b7d8"},"ecs":{"version":"1.6.0"},"message":"1765337417.024462\tC8vZVb2IWhu8ApPYYb\t172.30.1.12\t43662\t8.8.8.8\t53\tudp\t55085\t0.028022\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t201.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:18.083Z","host":{"name":"f6b540842a86"},"log":{"offset":474478,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"97e4aa5516c8307f7b2f89e09ba93b51ec4c203b0859b204c6e52a535c317a5b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337406.664254\tCYrDd52vzsW7FsT6B3\t172.30.1.12\t33483\t8.8.8.8\t53\tudp\tdns\t0.027449\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:18.521Z","host":{"name":"f6b540842a86"},"log":{"offset":470699,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0645d6e6e551cb2c9a024647fcfaa71ff1b54c0151cda9e213b1ee9af6eed746"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337357.105859\tCxI4Cg1tU4yPPK32R6\t172.30.1.16\t1900\t239.255.255.250\t1900\tudp\t-\t0.001456\t1403\t0\tS0\tT\tF\t0\tD\t4\t1515\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:18.521Z","host":{"name":"f6b540842a86"},"log":{"offset":470823,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5d01fd4217fdc30c98176ba46966dc108f0b1f61bb9d6dd477336192d450e1e2"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337407.694268\tCWo7452R3o3LbvVDv4\t172.30.1.12\t33853\t8.8.8.8\t53\tudp\tdns\t0.029169\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:18.521Z","host":{"name":"f6b540842a86"},"log":{"offset":470955,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"f57ef34660f7a6e2bfdbe64455835681f3b0a5a5d966d52ee82fcc7c7e25ca40"},"ecs":{"version":"1.6.0"},"message":"1765337418.054467\tC6DV2Y2yGRm5r5dtn9\t172.30.1.12\t60299\t8.8.8.8\t53\tudp\t55086\t0.027370\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t114.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:19.083Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":474653},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"82d156f8299a41f2e2d932f31f5c72044a5a043b08921481dbf6e69a22035b25"},"ecs":{"version":"1.6.0"},"message":"1765337419.084407\tChTYV9VIdAuH0JCHk\t172.30.1.12\t35191\t8.8.8.8\t53\tudp\t55087\t0.032086\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t113.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:20.084Z","host":{"name":"f6b540842a86"},"log":{"offset":474828,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6e2487859cef7993ee8a551a894e71956bbeb7fd1725c1e72efe0a361725d382"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337408.734296\tCtp70SZCsonJ9Rml1\t172.30.1.12\t49143\t8.8.8.8\t53\tudp\tdns\t0.028776\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:21.522Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":471079},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7529540fe4bf61ebef5de9363cb4506f8612784fa5ff9974f5cb1cf6bf371a1d"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337409.774328\tCfUjVK2ierob4SZLPk\t172.30.1.12\t54633\t8.8.8.8\t53\tudp\tdns\t0.026719\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:21.522Z","host":{"name":"f6b540842a86"},"log":{"offset":471202,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"23d5bfcea3f8dfc325dcfe4275240bfb46a60fda43ca9c214d42589bd6db623c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337335.258918\tCOWIwp1vXf8B9uaSal\t172.30.1.35\t54865\t142.250.66.99\t443\tudp\t-\t25.147658\t6074\t6496\tSF\tT\tF\t0\tDd\t13\t6438\t17\t6972\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:22.522Z","host":{"name":"f6b540842a86"},"log":{"offset":471326,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"6ea9a62e6a16d1a4f7e2512322523af4fde0f20aa919c7e090018441e6204398"},"ecs":{"version":"1.6.0"},"message":"1765337420.130283\tCC4NFD3YMZu0Q3igAl\t172.30.1.12\t43572\t8.8.8.8\t53\tudp\t55088\t0.022471\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t254.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.084Z","host":{"name":"f6b540842a86"},"log":{"offset":475002,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bf2a609022a3808943ff26ca4e87dcb52f7aff54f512f13b53e6b56f67d1d77b"},"ecs":{"version":"1.6.0"},"message":"1765337421.552454\tCcdWG71MZxyEoXV1f1\t172.30.1.35\t59071\t172.30.1.254\t53\tudp\t63144\t0.025358\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2399.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.085Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":475352},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"e5c23b4364e506682d3ef94831a8b5154f4420e57ad3b82e683ea481b57b091b"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337410.804297\tCRfeLr1CfzU5XYdrx7\t172.30.1.12\t42061\t8.8.8.8\t53\tudp\tdns\t0.027488\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:22.522Z","host":{"name":"f6b540842a86"},"log":{"offset":471466,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"dbca65944bcfc53e0bfcef55282fda464d8d2160f5165d9fa182a1c7e5d40d5b"},"ecs":{"version":"1.6.0"},"message":"1765337421.164746\tCPAA0e1BMjbUooZ0xi\t172.30.1.12\t55839\t8.8.8.8\t53\tudp\t55089\t0.026918\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t197.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.085Z","host":{"name":"f6b540842a86"},"log":{"offset":475177,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"443a7cad2ef760d821096df942811680fc9e20f26f6f2f418aedc04640002757"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337401.540423\tCKhygu34xgvUF24G32\t172.30.1.35\t63215\t172.30.1.254\t53\tudp\tdns\t2.018621\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.532Z","host":{"name":"f6b540842a86"},"log":{"offset":471590,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"363afbb1ace957bda8d9a8e26f7f256b849ac87539e5b60268e1dc300eceb8b7"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337411.539027\tCjGTsV2gqkDy50V2D1\t172.30.1.35\t60231\t172.30.1.254\t53\tudp\tdns\t0.005233\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.532Z","host":{"name":"f6b540842a86"},"log":{"offset":471844,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c04fca7f69469d3fe98eaea0b3d9b8e7e919f4db4bde42322807ec11f368e7c3"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337411.834270\tCAQG5aKFwAuxxUDo9\t172.30.1.12\t42499\t8.8.8.8\t53\tudp\tdns\t0.029281\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:23.532Z","host":{"name":"f6b540842a86"},"log":{"offset":471721,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5897fb4143fffdffad58f7a89e3160ce83168c318ddfe2077bafca119c774e48"},"ecs":{"version":"1.6.0"},"message":"1765337422.194832\tCOvFmG3B3ihmzqHPA5\t172.30.1.12\t57977\t8.8.8.8\t53\tudp\t55090\t0.029404\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t210.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:24.085Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":475526},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"73ea395eb1f50644375f63ede354ab2f8ff29b2d4b29cdcb2f5d1f8b408a1a22"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337128.188792\tC9PT7B2hChcEqD09r3\t172.30.1.254\t49267\t255.255.255.255\t29810\tudp\t-\t234.740196\t9912\t0\tS0\tT\tF\t0\tD\t24\t10584\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:24.532Z","host":{"name":"f6b540842a86"},"log":{"offset":472223,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cd7abcf5a8511dbefe186c86896e55253820a3e6800aec74e6ce6c4b37ee2807"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337412.874636\tCdimwB1YUahU36dOul\t172.30.1.12\t51161\t8.8.8.8\t53\tudp\tdns\t0.026774\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:24.532Z","host":{"name":"f6b540842a86"},"log":{"offset":471975,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d1388d6aeff521bef1c89754a0f64edb383ccf0d148932cddaf4af68a681edc0"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337417.560144\tCRyo42sQSfbFthcUk\t172.30.1.2\t52230\t172.30.4.139\t1514\ttcp\t-\t2.998927\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:24.532Z","host":{"name":"f6b540842a86"},"log":{"offset":472099,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d4944507bfa2234cb15832bd9eaaf3e65c9169a24a488d1f80471f7284cb3391"},"ecs":{"version":"1.6.0"},"message":"1765337423.234516\tCVRSUd2Qa77UoyN4zb\t172.30.1.12\t44880\t8.8.8.8\t53\tudp\t55091\t0.026914\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t195.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:25.088Z","host":{"name":"f6b540842a86"},"log":{"offset":475701,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0d561b43819682d2f4dac4b9e39c5ea8b8507fa8821f8dda138345f75fda691b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337363.432901\tCd9wil21TZFHzG2i32\t172.30.1.15\t138\t172.30.1.255\t138\tudp\t-\t-\t-\t-\tS0\tT\tT\t0\tD\t1\t229\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:25.536Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":472495},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"01cbdd8b8a659819b48d82d0539af14a10eedcf37c728840105e4581367d2759"},"ecs":{"version":"1.6.0"},"message":"1765337425.294497\tCVL9Gl3TNIUzwrkiE2\t172.30.1.12\t40518\t8.8.8.8\t53\tudp\t55093\t0.028462\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t107.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:26.089Z","host":{"name":"f6b540842a86"},"log":{"offset":476051,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"83c103f46ce1f779e39cf45a9aa6933e07f7c8b4f0df97ee23dcebc7fd2a853c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337413.904424\tCpZi0L3cGyvaWUwDtl\t172.30.1.12\t49561\t8.8.8.8\t53\tudp\tdns\t0.028758\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:25.536Z","host":{"name":"f6b540842a86"},"log":{"offset":472611,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"46f28315b04da85ba489754e5d80fa2420324857188d54ed82deb8e39c9a765a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337414.944333\tCUgz5yZnPcRYEbwl\t172.30.1.12\t46228\t8.8.8.8\t53\tudp\tdns\t0.029073\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:26.536Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":472860},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7915048459c6cfb34269e3856b49aeb2351f7586dbf5f83b03c09d4ed8a811d1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337364.040536\tCFfHfS3oew80KelwF2\t172.30.1.35\t61068\t8.8.4.4\t443\tudp\t-\t0.065931\t5693\t6481\tSF\tT\tF\t0\tDd\t11\t6001\t15\t6901\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:25.536Z","host":{"name":"f6b540842a86"},"log":{"offset":472362,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"37e638f76c39d5f7879c151957dec40632c9176159d6b8f40a0ae2b38f4f87f4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337419.952186\tCOJDDJ1Rq0bgICPYbe\t172.30.1.2\t59904\t172.30.4.136\t5044\ttcp\t-\t2.996898\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:26.536Z","host":{"name":"f6b540842a86"},"log":{"offset":472735,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"04d6a1904a5a64d0b73b9ae352d89debdb46b0232364dcdfd52981b90b64bbdd"},"ecs":{"version":"1.6.0"},"message":"1765337424.264520\tCM50Uf1icx9yAWElV2\t172.30.1.12\t42675\t8.8.8.8\t53\tudp\t55092\t0.027112\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t194.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:26.089Z","host":{"name":"f6b540842a86"},"log":{"offset":475876,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ac932bf9daed1401a705c36967a55397d4620dfc153d82df2cbee8e55fc9af83"},"ecs":{"version":"1.6.0"},"message":"1765337426.244927\tCB4V8azwNV7r6wRfd\t172.30.1.15\t4282\t8.8.8.8\t53\tudp\t1440\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:27.089Z","host":{"name":"f6b540842a86"},"log":{"offset":476226,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"36e2398370925122440011bb43ce8f881f5f5541c000d84435f6360fa3e4e08d"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337365.805352\tCXR3dX2GAPmhUFy54k\t172.30.1.35\t59210\t8.8.8.8\t443\tudp\t-\t0.063298\t4516\t6513\tSF\tT\tF\t0\tDd\t11\t4824\t15\t6933\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:27.536Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":473105},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b22d55949ff9446d7b3dddd988f203e01645f8946793840853c889291291c398"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337415.984491\tCYTSiRj9ER2LI1jck\t172.30.1.12\t60804\t8.8.8.8\t53\tudp\tdns\t0.029131\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:27.536Z","host":{"name":"f6b540842a86"},"log":{"offset":472982,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"60ac17431620fbec18949d986e03e930d5caafa4f7a938c59832e268099547ba"},"ecs":{"version":"1.6.0"},"message":"1765337426.322108\tCpslF82HFaJP3r3hLb\t172.30.1.15\t4284\t8.8.8.8\t53\tudp\t1440\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:27.089Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":476511},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"800a61ee7e80662f73aae3b95e0d696da133e8ed7d6155080bdc8c4826a9c63c"},"ecs":{"version":"1.6.0"},"message":"1765337426.289937\tCC6UHr4OdXJ0ZkliOa\t172.30.1.15\t4283\t8.8.8.8\t53\tudp\t1440\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:27.089Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":476368},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"167c34f463990f19313f9e38c179d734af77a3d366187c2520e7b2ee065696c3"},"ecs":{"version":"1.6.0"},"message":"1765337426.391480\tCpRzgI1wumGmadS7Ng\t172.30.1.15\t4286\t8.8.8.8\t53\tudp\t1440\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"offset":477146,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"34bb92ffa3d5d68c435cdf5e17c43944a79ebcf61e7c51098943ce9a8f74babb"},"ecs":{"version":"1.6.0"},"message":"1765337427.022313\tCiyCZF2b96q01ptQo1\t172.30.1.35\t55388\t172.30.1.254\t53\tudp\t14333\t0.003132\tc.pki.goog\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tpki-goog.l.google.com,142.250.66.99\t40.000000,190.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":477606},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a44705d3bf95b5bd27ce662649743ff17e99ebc092de0a01dd8b95d01cb8d119"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337417.024462\tC8vZVb2IWhu8ApPYYb\t172.30.1.12\t43662\t8.8.8.8\t53\tudp\tdns\t0.028022\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.537Z","host":{"name":"f6b540842a86"},"log":{"offset":473238,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"26f812e2ebe683feac3daf9e407372ba4e9940fa94ebd69ba4556cfe9ce80a41"},"ecs":{"version":"1.6.0"},"message":"1765337427.064079\tCPEjrO2HfG6uo9ICo5\t172.30.1.35\t50746\t172.30.1.254\t53\tudp\t31377\t0.003428\tctldl.windowsupdate.com\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\tctldl.windowsupdate.com.delivery.microsoft.com,wu-b-net.trafficmanager.net,bg.microsoft.map.fastly.net,199.232.166.172\t3017.000000,3600.000000,575.000000,54.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"offset":477289,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"33bb394ba542312aeca7fe57d5e7f593b6264e1981198378437b839bb2faf3c9"},"ecs":{"version":"1.6.0"},"message":"1765337426.339292\tCqhnIg3XWb0cpi1OTi\t172.30.1.12\t48313\t8.8.8.8\t53\tudp\t55094\t0.027083\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t192.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":476654},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"2d4c9689e0691bfa4bb3b5537c0d2a4fae453b3549008a1f21ec27d45ea1de22"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337416.539071\tCoy6Ny2TpXzseS7Sf7\t172.30.1.35\t51436\t172.30.1.254\t53\tudp\tdns\t0.005013\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.537Z","host":{"name":"f6b540842a86"},"log":{"offset":473362,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"a6efde755f1d65aaa81c67f8ac335a6cb45a39e8d5ea3992cb851bc53fa51f5f"},"ecs":{"version":"1.6.0"},"message":"1765337426.351431\tCXhVga3CBfezFoUQj7\t172.30.1.15\t4285\t8.8.8.8\t53\tudp\t1440\t-\tcaps04.fujixerox.co.jp\t1\tC_INTERNET\t1\tA\t2\tSERVFAIL\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"offset":476829,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5983ee7830b4cbfd236def3994bc3d16e67c7fb4db0532b15c42f2425b491f4b"},"ecs":{"version":"1.6.0"},"message":"1765337426.546052\tCWaBhi1noyeWI3IOa9\t172.30.1.35\t61390\t172.30.1.254\t53\tudp\t23845\t0.004974\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2370.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:28.090Z","host":{"name":"f6b540842a86"},"log":{"offset":476972,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"19f4cb6e54859df832cde997cd1bff8fd8fcd2e071cc31a1796257fb0fa2f61d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337368.044060\tCCGYklSwuA8JmnQUa\t172.30.1.35\t63957\t8.8.4.4\t443\tudp\t-\t0.065169\t4515\t6509\tSF\tT\tF\t0\tDd\t11\t4823\t15\t6929\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:29.537Z","host":{"name":"f6b540842a86"},"log":{"offset":473731,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b2ec1c98ce165217b99ce5d44584cea572c2ab414ce9317ab1a1f587ead712b4"},"ecs":{"version":"1.6.0"},"message":"1765337427.374590\tCGwUm12dXFJVdrR3pa\t172.30.1.12\t50039\t8.8.8.8\t53\tudp\t55095\t0.028816\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t191.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:29.090Z","host":{"name":"f6b540842a86"},"log":{"offset":477803,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"60652635c864041131a12af5b9ac21c5e2c77856f446320a1f3f10ac8848d992"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337418.054467\tC6DV2Y2yGRm5r5dtn9\t172.30.1.12\t60299\t8.8.8.8\t53\tudp\tdns\t0.027370\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:29.537Z","host":{"name":"f6b540842a86"},"log":{"offset":473607,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"54d065e550c717f7f9ab7ae3de204dff89d14123c7364515f3a476926d4ceed8"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337367.820258\tCl8oik427wCj0o1io1\t172.30.1.132\t3\t172.30.1.254\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tT\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:29.537Z","host":{"name":"f6b540842a86"},"log":{"offset":473493,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"044d6afb59b8dd5dd14e435e199ed90e721c78c32117b0851627f59bb0a1ee34"},"ecs":{"version":"1.6.0"},"message":"1765337428.414471\tCQnIw74QOusKzq4O96\t172.30.1.12\t51125\t8.8.8.8\t53\tudp\t55096\t0.027621\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t246.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:30.091Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":477978},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"fb01cee5659831f66ef1578f9f159abfccf5f8c97cd07982d25e81f6659a6008"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337368.106369\tCDpA0z1W7iiQjvn8w9\t172.30.1.35\t61930\t171.102.11.33\t443\tudp\t-\t0.142573\t8854\t7460\tSF\tT\tF\t0\tDd\t15\t9274\t19\t7992\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:30.542Z","host":{"name":"f6b540842a86"},"log":{"offset":474119,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"68c26ace436c46f67442d8dc3943b9e5945cd55db1d3361dd3e478ff4f833e44"},"ecs":{"version":"1.6.0"},"message":"1765337429.444504\tC7JPz23hfiZJkKalce\t172.30.1.12\t33826\t8.8.8.8\t53\tudp\t55097\t0.029270\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t189.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:30.091Z","host":{"name":"f6b540842a86"},"log":{"offset":478153,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ba214b8f06211ea970c5796f7c065b77503a6fd46acceab944bb9fe077b37a73"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337419.084407\tChTYV9VIdAuH0JCHk\t172.30.1.12\t35191\t8.8.8.8\t53\tudp\tdns\t0.032086\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:30.542Z","host":{"name":"f6b540842a86"},"log":{"offset":473863,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"455126fc75f7c7ecf9c3f768f25a48ddd031dcf3575c1a0ccd480c95eb6c8929"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337424.114919\tCwuUVE4oPx00FMlFO\t172.30.1.35\t52162\t172.30.2.17\t7680\ttcp\t-\t0.002405\t75\t0\tSF\tT\tT\t0\tShADfFa\t5\t287\t3\t132\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:30.542Z","host":{"name":"f6b540842a86"},"log":{"offset":473986,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"873ed0db06576e1e3a70baa8016a0f1bd9234667e7bd31c93958c2a2e04fcfca"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337420.124387\tCC4NFD3YMZu0Q3igAl\t172.30.1.12\t43572\t8.8.8.8\t53\tudp\tdns\t0.028367\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:31.542Z","host":{"name":"f6b540842a86"},"log":{"offset":474258,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"d9bee536e6d4300aa8a41f085a3fb983ec2dd982d82ffeb6a31b6a350dcec775"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337421.164746\tCPAA0e1BMjbUooZ0xi\t172.30.1.12\t55839\t8.8.8.8\t53\tudp\tdns\t0.026918\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:32.545Z","host":{"name":"f6b540842a86"},"log":{"offset":474382,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"5c6cce6b50bd02efcf8bd436ababb8f06bdeec237767de30e954cc645383b278"},"ecs":{"version":"1.6.0"},"message":"1765337431.550812\tCFgV614S8V6BHlnxA4\t172.30.1.35\t50178\t172.30.1.254\t53\tudp\t57066\t0.005046\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2365.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:33.109Z","host":{"name":"f6b540842a86"},"log":{"offset":478503,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"3f4ab61a70abe8bc9d6c452564794f5686b11cdeb63313c79673541e5ef51d93"},"ecs":{"version":"1.6.0"},"message":"1765337431.525156\tCYAHW11YeoX8W2u027\t172.30.1.12\t58834\t8.8.8.8\t53\tudp\t55099\t0.028202\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t243.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:33.109Z","host":{"name":"f6b540842a86"},"log":{"offset":478677,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bae1f3d39d99756597794088243a9e3ba92d06038a6a1285f415f8afd18b70fe"},"ecs":{"version":"1.6.0"},"message":"1765337430.484566\tCQUxzf4OroQnwyZaVi\t172.30.1.12\t45937\t8.8.8.8\t53\tudp\t55098\t0.029542\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t188.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:33.109Z","host":{"name":"f6b540842a86"},"log":{"offset":478328,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"80aa8ac9acb5378849fcfe75b8c214ad4f169690115558d87bb0d96159515e85"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337421.552454\tCcdWG71MZxyEoXV1f1\t172.30.1.35\t59071\t172.30.1.254\t53\tudp\tdns\t0.025358\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:33.545Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":474506},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"725d11a60469133805fb030fa9983cd89cfb2ae4a801cbdedfcf28949252a23c"},"ecs":{"version":"1.6.0"},"message":"1765337432.564544\tCKZ5Q44KFNbW6b6CNj\t172.30.1.12\t53648\t8.8.8.8\t53\tudp\t55100\t0.026907\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t100.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:34.110Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":478852},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7041c42de4b934195f4b0978644cbdbf43a307a44a678b72ea87a421aaf955ca"},"ecs":{"version":"1.6.0"},"message":"1765337432.739248\tC8eavpBMv41dEsXy\t172.30.1.132\t35962\t8.8.8.8\t53\tudp\t14128\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:34.110Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":479027},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"bd1f43aa53da08b9218a1d950f21ff9eb569850001ac8270cbabd9291ada2d36"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337422.194832\tCOvFmG3B3ihmzqHPA5\t172.30.1.12\t57977\t8.8.8.8\t53\tudp\tdns\t0.029404\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:33.545Z","host":{"name":"f6b540842a86"},"log":{"offset":474637,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"92ae66d43f15659ab28fe9b6689a33113454a545d5f166f398288726d8bd679d"},"ecs":{"version":"1.6.0"},"message":"1765337432.739310\tCJdSNu3GqXp96kwvn1\t172.30.1.132\t35962\t172.30.1.254\t53\tudp\t14128\t-\t132.1.30.172.in-addr.arpa\t1\tC_INTERNET\t12\tPTR\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tT","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:34.110Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":479177},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c4df33b55008b69d796edbad884209038e8f3c15e1966ab98369ac7b351bbc1d"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337423.234516\tCVRSUd2Qa77UoyN4zb\t172.30.1.12\t44880\t8.8.8.8\t53\tudp\tdns\t0.026914\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:34.546Z","host":{"name":"f6b540842a86"},"log":{"offset":474761,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"64c496302c99f4e5fcca66699070a2a9a07595b267408ff2f09228af8079747b"},"ecs":{"version":"1.6.0"},"message":"1765337433.594519\tCU5mmd4vb93jwCv1ih\t172.30.1.12\t59226\t8.8.8.8\t53\tudp\t55101\t0.028910\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t185.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:35.110Z","host":{"name":"f6b540842a86"},"log":{"offset":479334,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"c825868136eb64d8f1a43dd009fde93b2804c1a58e45af68694535581caa2cd3"},"ecs":{"version":"1.6.0"},"message":"1765337434.634661\tCt6tbR3VprVk9JFkef\t172.30.1.12\t57385\t8.8.8.8\t53\tudp\t55102\t0.027926\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t184.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:35.110Z","host":{"name":"f6b540842a86"},"log":{"offset":479509,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"71736dbac17a9030decf089e35a1ec803ebeb2dc440c57ba44602cdf2836fd58"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337373.393807\tCF62tR2Jj3C2wVlxNj\t172.30.1.132\t55503\t216.239.35.12\t123\tudp\tntp\t0.030299\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:35.546Z","host":{"name":"f6b540842a86"},"log":{"offset":474885,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"4b9ddd4014e52e6befab91feaf2a2779dcbcc9538b2e845d57b03fc961212526"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337425.294497\tCVL9Gl3TNIUzwrkiE2\t172.30.1.12\t40518\t8.8.8.8\t53\tudp\tdns\t0.028462\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:36.547Z","host":{"name":"f6b540842a86"},"log":{"offset":475141,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"b9b7a69899bff75842ff25153d14b4ea32e11ef2ade10c9a3151bd43a575a153"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337424.264520\tCM50Uf1icx9yAWElV2\t172.30.1.12\t42675\t8.8.8.8\t53\tudp\tdns\t0.027112\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:30:36.547Z","host":{"name":"f6b540842a86"},"log":{"offset":475017,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"7ca858d2a675b3e20aa7f8a5808ef40e77fbd57f282cf0ef2d813643fdd488b5"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337731.167532\tCnjhAQ1vcvp5FvYrUc\t172.30.1.12\t59422\t8.8.8.8\t53\tudp\tdns\t0.038701\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:42.782Z","host":{"name":"f6b540842a86"},"log":{"offset":553664,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9abc9f7802f3f4255d34b2a331f84e09d70e0da144ffe75482195cee5f541fde"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337721.543762\tCp2zwJ1s7LSCGDdQKh\t172.30.1.35\t49780\t172.30.1.254\t53\tudp\tdns\t2.015303\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:43.782Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":553919},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"9a8e1f58cb43314b539e0866eb6af0e5006e83a1598614c1d3e52a0341d077a8"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765334110.348653\tCPW5Dl17CyNu3u11m\t193.163.125.254\t46526\t172.30.1.2\t80\ttcp\t-\t31.004951\t0\t0\tS1\tF\tT\t0\tSh\t1\t60\t6\t360\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:43.782Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":554299},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"cde8aefc62268b66bb438348f0f14fb6ffb4cde35a0d0a047c2625c871471707"},"ecs":{"version":"1.6.0"},"message":"1765337743.567591\tCj29Gz49Q2GjFGH1M8\t172.30.1.12\t39878\t8.8.8.8\t53\tudp\t55407\t0.026905\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t175.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:44.328Z","host":{"name":"f6b540842a86"},"log":{"offset":558020,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"de8c0e352359d1edf28e9e9210d9769534a4697c90115c87220ef9ef222defbf"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337731.582948\tCgL1YgDmQOq5vIwEa\t172.30.1.35\t60247\t8.8.8.8\t53\tudp\tdns\t0.027647\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:43.782Z","host":{"name":"f6b540842a86"},"log":{"offset":554050,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"567028af86a699f7c072b34a3b44f71c5a8cceee540fbbe73ddc4ddde36fed67"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337732.197438\tCAnQ2837xr1XOLRr9d\t172.30.1.12\t58484\t8.8.8.8\t53\tudp\tdns\t0.028536\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:43.782Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":554175},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"57cddbe06437b58510e2e947e5ccf4a8e526a889feb2fc9116573523cb8a95a5"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337733.237496\tC16rJO1ReXNV45jHc7\t172.30.1.12\t43806\t8.8.8.8\t53\tudp\tdns\t0.026701\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:44.783Z","host":{"name":"f6b540842a86"},"log":{"offset":554427,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"16075f1299123d9c469ba45b0908dafe7927a9e94531ad27613208218803c62c"},"ecs":{"version":"1.6.0"},"message":"1765337744.597576\tCwecAZMzIIp7u72vf\t172.30.1.12\t45071\t8.8.8.8\t53\tudp\t55408\t0.027236\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t88.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:45.329Z","host":{"name":"f6b540842a86"},"log":{"offset":558195,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"0635781168ecf4e57be2aef28e0f678483a5709a0ed43a7dbbc4c4baa9eb8639"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337734.267479\tCfE4HF2YBcmB1B9hw5\t172.30.1.12\t53350\t8.8.8.8\t53\tudp\tdns\t0.026701\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:45.783Z","host":{"name":"f6b540842a86"},"log":{"offset":554551,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

{"@version":"1","event":{"hash":"ba020d5839c51e1c9c0a5922ccc3e8ea28e616318078073b6b392a3e20debc3b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337726.553170\tCTV7bH32ujvxcWIYu8\t172.30.1.35\t50855\t172.30.1.254\t53\tudp\tdns\t2.015958\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:35:48.785Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":554799},"tags":["beats_input_codec_plain_applied"]}