Kafdrop: Topic: logstash-local-network: Messages

Offset: 666558 Key: Timestamp: 2025-12-10 03:36:36.461 Headers: empty

{"@version":"1","event":{"hash":"fe0535140fddbba97023a5cf0f59cd1360c03ca455a02932cd62513f246ba5e7"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337784.988165\tCZybsp2mMjo4ZXlFd5\t172.30.1.12\t40235\t8.8.8.8\t53\tudp\tdns\t0.028060\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:35.824Z","host":{"name":"f6b540842a86"},"log":{"offset":567452,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666559 Key: Timestamp: 2025-12-10 03:36:37.461 Headers: empty

{"@version":"1","event":{"hash":"ed50599b57ca7d616ae107f7bafaee825577b7a3b4462c391ab70846fcdbc172"},"ecs":{"version":"1.6.0"},"message":"1765337795.328051\tCwFekF4CJKuhWCuDpb\t172.30.1.12\t56335\t8.8.8.8\t53\tudp\t55458\t0.027471\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t73.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:36.358Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":569961},"tags":["beats_input_codec_plain_applied"]}

Offset: 666560 Key: Timestamp: 2025-12-10 03:36:37.461 Headers: empty

{"@version":"1","event":{"hash":"c0fa067245d3350f920c659d12edadce6ce1ae0b8eb06169c031e07bb1d84f26"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337665.078426\tChm81o3MkF7MsXg778\t172.30.1.35\t52177\t150.171.27.11\t443\ttcp\tssl\t125.961840\t2776\t6943\tRSTR\tT\tF\t0\tShADadTr\t13\t3310\t17\t7659\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:36.825Z","host":{"name":"f6b540842a86"},"log":{"offset":567822,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666561 Key: Timestamp: 2025-12-10 03:36:37.461 Headers: empty

{"@version":"1","event":{"hash":"9bbe4d008ef019272b46487733ef0851bb91709cd5201f6d8212a39d98b1a370"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337786.028046\tCNE8vqgRJhFcGHrgi\t172.30.1.12\t45116\t8.8.8.8\t53\tudp\tdns\t0.027927\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:36.825Z","host":{"name":"f6b540842a86"},"log":{"offset":567699,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666562 Key: Timestamp: 2025-12-10 03:36:38.461 Headers: empty

{"@version":"1","event":{"hash":"d4bb699ae98b8aef8d8aa74ac83967c3d4b8a766d97076004934585710b97fe1"},"ecs":{"version":"1.6.0"},"message":"1765337796.547731\tCzdU0b2ma8JojISba1\t172.30.1.35\t63247\t172.30.1.254\t53\tudp\t15345\t0.003955\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1168.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:37.358Z","host":{"name":"f6b540842a86"},"log":{"offset":570309,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666563 Key: Timestamp: 2025-12-10 03:36:38.461 Headers: empty

{"@version":"1","event":{"hash":"bc49f8a1298fb4f642cae7a03a702cddb7935e2ac3d8585910e7d7b8cbb727a6"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337786.589542\tCVnU6J3FbYRtEMsZDc\t172.30.1.35\t52800\t8.8.8.8\t53\tudp\tdns\t0.028163\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:37.825Z","host":{"name":"f6b540842a86"},"log":{"offset":567973,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666564 Key: Timestamp: 2025-12-10 03:36:38.461 Headers: empty

{"@version":"1","event":{"hash":"6fbde024b1293dbf91fbf27daa1d33771ab0546a29d03cc8079ca808f98dc231"},"ecs":{"version":"1.6.0"},"message":"1765337792.274307\tCoPTMh3rzWeKOojPXd\t202.46.62.37\t42919\t172.30.1.2\t80\t1\t-\t-\t-\t-\t1.1\t-\t-\t0\t220\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFRNk1u1iRZv8RFuAU9\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:37.730Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/http.log"},"offset":22797},"tags":["beats_input_codec_plain_applied"]}

Offset: 666565 Key: Timestamp: 2025-12-10 03:36:38.461 Headers: empty

{"@version":"1","event":{"hash":"8b5b42b8dd2a9bf875680d357f6cf61830939dc60a93a922a39aabfa2d6caf91"},"ecs":{"version":"1.6.0"},"message":"1765337796.358101\tCxy4vl1Vr9WrmQZvh3\t172.30.1.12\t50909\t8.8.8.8\t53\tudp\t55459\t0.028431\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t36.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:37.358Z","host":{"name":"f6b540842a86"},"log":{"offset":570135,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666566 Key: Timestamp: 2025-12-10 03:36:39.462 Headers: empty

{"@version":"1","event":{"hash":"02f119a2e29c731de3f46a2ee3240c2f2f8c6c2c6887b87737ae988e03b04d20"},"ecs":{"version":"1.6.0"},"message":"1765337797.398523\tC9wu6b1ck4UfNd6ZCi\t172.30.1.12\t53744\t8.8.8.8\t53\tudp\t55460\t0.029993\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t121.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:38.358Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":570483},"tags":["beats_input_codec_plain_applied"]}

Offset: 666567 Key: Timestamp: 2025-12-10 03:36:39.463 Headers: empty

{"@version":"1","event":{"hash":"edb7aca7d3cc39664120fc1aac167def5570095a96eb12d83350414c3e5613bb"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337792.126397\tCoPTMh3rzWeKOojPXd\t202.46.62.37\t42919\t172.30.1.2\t80\ttcp\t-\t0.703226\t274\t428\tSF\tF\tT\t274\tShaGdfADTtF\t7\t932\t9\t1772\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:38.826Z","host":{"name":"f6b540842a86"},"log":{"offset":568222,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666568 Key: Timestamp: 2025-12-10 03:36:39.463 Headers: empty

{"@version":"1","event":{"hash":"31021282cc4c1025bb1a7db4f3eea7556181fc6fcdb24b7c58b26557635b3e0a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337787.058012\tCKPltc5QrbPav0xce\t172.30.1.12\t37268\t8.8.8.8\t53\tudp\tdns\t0.029140\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:38.826Z","host":{"name":"f6b540842a86"},"log":{"offset":568099,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666569 Key: Timestamp: 2025-12-10 03:36:39.463 Headers: empty

{"@version":"1","event":{"hash":"0a594fd52211e1bca645fece44b120b19bac56aac999d73201aa37b861474226"},"ecs":{"version":"1.6.0"},"message":"1765337798.438135\tCYfnHF4KdGVLztFh21\t172.30.1.12\t41143\t8.8.8.8\t53\tudp\t55461\t0.027404\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t120.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:39.359Z","host":{"name":"f6b540842a86"},"log":{"offset":570658,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666570 Key: Timestamp: 2025-12-10 03:36:40.929 Headers: empty

{"@version":"1","event":{"hash":"e9a5b3c42766e4449305a5db06524e9966d5e44b3af1cea0c6ddc968417493fa"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337788.098054\tCt5XYe2lhF70oDfzY6\t172.30.1.12\t56983\t8.8.8.8\t53\tudp\tdns\t0.028168\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:39.826Z","host":{"name":"f6b540842a86"},"log":{"offset":568364,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666571 Key: Timestamp: 2025-12-10 03:36:41.930 Headers: empty

{"@version":"1","event":{"hash":"a0743eeba115d9900b39f455277821080776abb5fef126e35fbf5b76aa996168"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337789.128230\tCtqE571z3EP5uRtgnd\t172.30.1.12\t51973\t8.8.8.8\t53\tudp\tdns\t0.027699\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:40.826Z","host":{"name":"f6b540842a86"},"log":{"offset":568488,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666572 Key: Timestamp: 2025-12-10 03:36:41.930 Headers: empty

{"@version":"1","event":{"hash":"04e4a147a5718788f5749fcb04ff8360580ea45a9171029a281b66b8702cfa72"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337789.369013\tChHw3g2NzmppdYGT28\t172.30.1.35\t61101\t172.30.1.254\t53\tudp\tdns\t0.003663\t48\t170\tSF\tT\tT\t0\tDd\t1\t76\t1\t198\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:40.826Z","host":{"name":"f6b540842a86"},"log":{"offset":568612,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666573 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"75630b670677c2d4907179e8a1d3a2fc239c687c62b9b838484642c2bc671200"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337789.378500\tCzwridwbotQFkKAmd\t172.30.1.35\t52182\t51.105.71.136\t443\ttcp\tssl\t6.121664\t2361\t7313\tRSTO\tT\tF\t529\tShADdgaR\t14\t2933\t10\t7725\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:41.827Z","host":{"name":"f6b540842a86"},"log":{"offset":568743,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666574 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"968142599d3ac0316665a27941e48555c4344a6c70b70007df128caf4348c40c"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337790.158046\tC0DnH61q2Jt2LfeNDb\t172.30.1.12\t48017\t8.8.8.8\t53\tudp\tdns\t0.029324\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:41.827Z","host":{"name":"f6b540842a86"},"log":{"offset":568893,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666575 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"5f7a2a381372fe7c6f816e8e1be3d43f31be81c14e7c0d6b141434524dce3394"},"ecs":{"version":"1.6.0"},"message":"1765337799.468136\tCUNSZf1zXZe84e40h1\t172.30.1.12\t50161\t8.8.8.8\t53\tudp\t55462\t0.026903\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t175.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.359Z","host":{"name":"f6b540842a86"},"log":{"offset":570833,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666576 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"5c6cf6e4aabde1c403ce841ed523d8a46ca3b7b506cccca47269cc34ba58be95"},"ecs":{"version":"1.6.0"},"message":"1765337800.498142\tC9BCs63PU2ddaoQnC4\t172.30.1.12\t52150\t8.8.8.8\t53\tudp\t55463\t0.049114\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t118.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.360Z","host":{"name":"f6b540842a86"},"log":{"offset":571008,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666577 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"e406b6c6304fada20398d46916283c045d7f9f4d03e7cc3c3fcde994eaa4e0ac"},"ecs":{"version":"1.6.0"},"message":"1765337801.538164\tCxdcwu00ti3Xg0Um5\t172.30.1.12\t33077\t8.8.8.8\t53\tudp\t55464\t0.029119\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t117.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.360Z","host":{"name":"f6b540842a86"},"log":{"offset":571183,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666578 Key: Timestamp: 2025-12-10 03:36:42.937 Headers: empty

{"@version":"1","event":{"hash":"7219e0b6d6963c61e0dc4525a22b0db7d799b3ad74f3d6b237244d5f66de0a79"},"ecs":{"version":"1.6.0"},"message":"1765337801.600316\tCsMwzt3D18taQxfZr\t172.30.1.35\t50410\t172.30.1.254\t53\tudp\t43896\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1163.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.360Z","host":{"name":"f6b540842a86"},"log":{"offset":571357,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666579 Key: Timestamp: 2025-12-10 03:36:43.938 Headers: empty

{"@version":"1","event":{"hash":"c62669e11631afc86eb582394af9da1a10ef85e2472cc790f361ddd0e03422bd"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337791.587658\tC1XXPr3CxItDYLkAbd\t172.30.1.35\t56478\t8.8.8.8\t53\tudp\tdns\t0.028165\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.827Z","host":{"name":"f6b540842a86"},"log":{"offset":569141,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666580 Key: Timestamp: 2025-12-10 03:36:43.938 Headers: empty

{"@version":"1","event":{"hash":"b01b250444305ff3a136f4d62119fb45ad6d2277da08c75998d344afb119337e"},"ecs":{"version":"1.6.0"},"message":"1765337802.578148\tC9X3l61KLCaVzlFJMd\t172.30.1.12\t44608\t8.8.8.8\t53\tudp\t55465\t0.026952\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t30.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:43.360Z","host":{"name":"f6b540842a86"},"log":{"offset":571523,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666581 Key: Timestamp: 2025-12-10 03:36:43.938 Headers: empty

{"@version":"1","event":{"hash":"9759eaaaa7778421deac6b0c12c0d336b93a5af39f8747ec1cc161bfbe369a3b"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337791.198439\tCiwLUj1M6517lfmn8d\t172.30.1.12\t43176\t8.8.8.8\t53\tudp\tdns\t0.026009\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:42.827Z","host":{"name":"f6b540842a86"},"log":{"offset":569017,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666582 Key: Timestamp: 2025-12-10 03:36:44.938 Headers: empty

{"@version":"1","event":{"hash":"1053e3d974fcde11b4bc827f040148f26648d522e8eb1092406923a6f60efb7b"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337792.232992\tCUWIGe30D5xu4kWRzl\t172.30.1.12\t36064\t8.8.8.8\t53\tudp\tdns\t0.022371\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:43.835Z","host":{"name":"f6b540842a86"},"log":{"offset":569267,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666583 Key: Timestamp: 2025-12-10 03:36:45.940 Headers: empty

{"@version":"1","event":{"hash":"5dd376d819888fc7b740fb8ee97cce1d38ffaba22e60c5ccdc4715b420bf1de0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337793.258125\tClrsF52ALOYtFLpPii\t172.30.1.12\t52110\t8.8.8.8\t53\tudp\tdns\t0.027042\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:44.836Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":569391},"tags":["beats_input_codec_plain_applied"]}

Offset: 666584 Key: Timestamp: 2025-12-10 03:36:46.939 Headers: empty

{"@version":"1","event":{"hash":"04f606b1ba65edf34fda23e376dc1bb924be33abc2db28fd3ee8a931644b86bd"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337794.288022\tCVWD0Y9HtF4hiZIk7\t172.30.1.12\t35821\t8.8.8.8\t53\tudp\tdns\t0.028830\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:45.836Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":569515},"tags":["beats_input_codec_plain_applied"]}

Offset: 666585 Key: Timestamp: 2025-12-10 03:36:46.940 Headers: empty

{"@version":"1","event":{"hash":"72f32bf3ecd87491c2fe2a5dd70734eec72a336011147fa2a1ae0bc25c8b907b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337799.600381\tCC4eyT31XCHyWRjjo\t172.30.1.2\t52314\t172.30.4.139\t1514\ttcp\t-\t2.998698\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:45.836Z","host":{"name":"f6b540842a86"},"log":{"offset":569638,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666586 Key: Timestamp: 2025-12-10 03:36:46.940 Headers: empty

{"@version":"1","event":{"hash":"9b05dc9324f072fed65ed4358aede0cf084757d9a6b86da7da8861b58af13f5f"},"ecs":{"version":"1.6.0"},"message":"1765337804.652372\tC3g7Rh3lojAWI7eLn8\t172.30.1.12\t58568\t8.8.8.8\t53\tudp\t55467\t0.014209\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t114.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:46.361Z","host":{"name":"f6b540842a86"},"log":{"offset":571872,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666587 Key: Timestamp: 2025-12-10 03:36:46.940 Headers: empty

{"@version":"1","event":{"hash":"056934ac8b034f55cec312e85c89891f17bfa128d5dfb25d2b024fedc0254dbb"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337795.328051\tCwFekF4CJKuhWCuDpb\t172.30.1.12\t56335\t8.8.8.8\t53\tudp\tdns\t0.027471\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:46.836Z","host":{"name":"f6b540842a86"},"log":{"offset":569762,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666588 Key: Timestamp: 2025-12-10 03:36:46.940 Headers: empty

{"@version":"1","event":{"hash":"9a49c3ba2e29569c3a5bafe47c92878614a763d0303d61fa079a44c1e53cbc52"},"ecs":{"version":"1.6.0"},"message":"1765337803.608445\tC66buE1OZWUP1Khjka\t172.30.1.12\t53738\t8.8.8.8\t53\tudp\t55466\t0.026913\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t171.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:46.361Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":571697},"tags":["beats_input_codec_plain_applied"]}

Offset: 666589 Key: Timestamp: 2025-12-10 03:36:48.465 Headers: empty

{"@version":"1","event":{"hash":"fa2c140bef035156433645ca24c75e6df734ef8573e428d64b080227d402b6d4"},"ecs":{"version":"1.6.0"},"message":"1765337805.678494\tCnrPa01YbLx4Nd81Ed\t172.30.1.12\t57057\t8.8.8.8\t53\tudp\t55468\t0.028911\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t63.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:47.361Z","host":{"name":"f6b540842a86"},"log":{"offset":572047,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666590 Key: Timestamp: 2025-12-10 03:36:48.465 Headers: empty

{"@version":"1","event":{"hash":"136dffed67ba7575964e61235b1abc6494b559c6e1c96a7e98568c2bd39c0263"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337796.358101\tCxy4vl1Vr9WrmQZvh3\t172.30.1.12\t50909\t8.8.8.8\t53\tudp\tdns\t0.028431\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:47.837Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":569886},"tags":["beats_input_codec_plain_applied"]}

Offset: 666591 Key: Timestamp: 2025-12-10 03:36:49.465 Headers: empty

{"@version":"1","event":{"hash":"fe0e4b45f17b545c0dedab84068b9205d11817148718c87bc98acf7a0a977da5"},"ecs":{"version":"1.6.0"},"message":"1765337806.565086\tCimCED3WI45hbrsuOi\t172.30.1.35\t65200\t172.30.1.254\t53\tudp\t21203\t0.004769\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2014.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:48.362Z","host":{"name":"f6b540842a86"},"log":{"offset":572221,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666592 Key: Timestamp: 2025-12-10 03:36:49.465 Headers: empty

{"@version":"1","event":{"hash":"4596cfaa062f3fe6bd6c9c2474b4b49e6e41eec868194baa194a1b608ec6e0e5"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337786.557980\tCvrpdz4iiKKKGWxwZf\t172.30.1.35\t52800\t172.30.1.254\t53\tudp\tdns\t1.335758\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:48.837Z","host":{"name":"f6b540842a86"},"log":{"offset":570141,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666593 Key: Timestamp: 2025-12-10 03:36:49.465 Headers: empty

{"@version":"1","event":{"hash":"c69ea25e2ecefee82d97d487c5f3120bc9261f47926e12a5b6c946c7fd80fdcd"},"ecs":{"version":"1.6.0"},"message":"1765337806.718411\tCL8UCD4SS5DLv1D9le\t172.30.1.12\t33319\t8.8.8.8\t53\tudp\t55469\t0.028379\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t112.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:48.362Z","host":{"name":"f6b540842a86"},"log":{"offset":572395,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666594 Key: Timestamp: 2025-12-10 03:36:49.465 Headers: empty

{"@version":"1","event":{"hash":"fc4f8dc1aa89b0ccc4f4b92ce55fa3ab99254545ca9145381531bfb115925c1c"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337796.547731\tCzdU0b2ma8JojISba1\t172.30.1.35\t63247\t172.30.1.254\t53\tudp\tdns\t0.003955\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:48.837Z","host":{"name":"f6b540842a86"},"log":{"offset":570010,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666595 Key: Timestamp: 2025-12-10 03:36:50.465 Headers: empty

{"@version":"1","event":{"hash":"59cbf7166e9fd24908b52884509d18ce265b5e541c192c6a4baf196da98b6b07"},"ecs":{"version":"1.6.0"},"message":"1765337805.265902\tFksrMP2zqo2aGm2Boa\t3\t06B81D8F3880317F63739450833BAE49\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t1740960000.000000\t1772841599.000000\trsaEncryption\tsha256WithRSAEncryption\trsa\t2048\t65537\t-\tsiamsecure.net,www.siamsecure.net\t-\t-\t-\tF\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:49.761Z","host":{"name":"f6b540842a86"},"log":{"offset":32055,"file":{"path":"/usr/share/filebeat/logs/x509.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666596 Key: Timestamp: 2025-12-10 03:36:50.465 Headers: empty

{"@version":"1","event":{"hash":"23c41c9fa2e994582a88d7733bd59bb750bf4a13692d459c22d241273ea215a4"},"ecs":{"version":"1.6.0"},"message":"1765337805.256059\tCiwis63MQgGccLkrz6\t202.46.62.46\t16192\t172.30.1.2\t443\tTLSv12\tTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\tsecp521r1\twww.siamsecure.net\tF\t-\t-\tT\tFksrMP2zqo2aGm2Boa,FhxGG64bwZrpzOLUy5\t(empty)\tCN=siamsecure.net\tCN=RapidSSL TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US\t-\t-\tok\tc54a639adf4392674c538ef931f003d6\tbef8041fc75fa81ab9e6467bcef0f376","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:49.820Z","host":{"name":"f6b540842a86"},"log":{"offset":38359,"file":{"path":"/usr/share/filebeat/logs/ssl.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666597 Key: Timestamp: 2025-12-10 03:36:50.465 Headers: empty

{"@version":"1","event":{"hash":"6dfd5fb19834abe3ce7eeafdbbfb3abfef571350df4e800c731b37e4b2d50818"},"ecs":{"version":"1.6.0"},"message":"1765337807.758309\tCy1DP934y8UhBJCj93\t172.30.1.12\t60634\t8.8.8.8\t53\tudp\t55470\t0.031793\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t25.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:49.362Z","host":{"name":"f6b540842a86"},"log":{"offset":572570,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666598 Key: Timestamp: 2025-12-10 03:36:50.466 Headers: empty

{"@version":"1","event":{"hash":"40587d9c97a9cfa79b48032a09d4ac899670a0ec510d2c9af686b2390155dc4a"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337797.398523\tC9wu6b1ck4UfNd6ZCi\t172.30.1.12\t53744\t8.8.8.8\t53\tudp\tdns\t0.029993\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:49.838Z","host":{"name":"f6b540842a86"},"log":{"offset":570272,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666599 Key: Timestamp: 2025-12-10 03:36:50.466 Headers: empty

{"@version":"1","event":{"hash":"724f4402c3e7b9fb00d8742fc7ee275e3c96e42ec9d29d650eb37813ccdfc4a9"},"ecs":{"version":"1.6.0"},"message":"1765337808.798537\tCtEIbQ3DqC3YPP2jji\t172.30.1.12\t45314\t8.8.8.8\t53\tudp\t55471\t0.028895\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t110.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:50.362Z","host":{"name":"f6b540842a86"},"log":{"offset":572744,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666600 Key: Timestamp: 2025-12-10 03:36:51.942 Headers: empty

{"@version":"1","event":{"hash":"657c21f082c23101bbd5e777ac3ba1420571c6457720f1c65d95c05b28c15fd2"},"ecs":{"version":"1.6.0"},"message":"1765337809.838378\tCaqXbfqQM4ojFj57g\t172.30.1.12\t45544\t8.8.8.8\t53\tudp\t55472\t0.028129\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t109.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:51.363Z","host":{"name":"f6b540842a86"},"log":{"offset":572919,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666601 Key: Timestamp: 2025-12-10 03:36:51.942 Headers: empty

{"@version":"1","event":{"hash":"e08ff3949a98d58b309539d191e05266283693e8dd5572aebcc41cab98329fa0"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337798.438135\tCYfnHF4KdGVLztFh21\t172.30.1.12\t41143\t8.8.8.8\t53\tudp\tdns\t0.027404\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:50.839Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":570396},"tags":["beats_input_codec_plain_applied"]}

Offset: 666602 Key: Timestamp: 2025-12-10 03:36:51.942 Headers: empty

{"@version":"1","event":{"hash":"b85b9a475cb70495c406827e7d73be5637b59d491102f9cd788d2d1896c9777a"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337799.468136\tCUNSZf1zXZe84e40h1\t172.30.1.12\t50161\t8.8.8.8\t53\tudp\tdns\t0.026903\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:50.839Z","host":{"name":"f6b540842a86"},"log":{"offset":570520,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666603 Key: Timestamp: 2025-12-10 03:36:52.946 Headers: empty

{"@version":"1","event":{"hash":"9d848b52b9f096d3e19e0e9605b8bb43ffdbbcd372ab110af8237d5a1e2ab385"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337804.358229\tCGd7X2VqHiuBVHNok\t172.30.1.2\t59988\t172.30.4.136\t5044\ttcp\t-\t2.990869\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:51.840Z","host":{"name":"f6b540842a86"},"log":{"offset":570644,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666604 Key: Timestamp: 2025-12-10 03:36:52.946 Headers: empty

{"@version":"1","event":{"hash":"286c104e63ebb5b9564ca5ecde76fa03a025b1408cb2fa7e8e94c198b061dd18"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337805.001453\tCgzi5I3YEm1dPGtfyg\t202.46.62.28\t39424\t172.30.1.2\t80\ttcp\thttp\t0.163569\t312\t512\tSF\tF\tT\t0\tShADadfF\t6\t632\t5\t780\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:51.840Z","host":{"name":"f6b540842a86"},"log":{"offset":570904,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666605 Key: Timestamp: 2025-12-10 03:36:52.946 Headers: empty

{"@version":"1","event":{"hash":"ae53189800315704726a180a0408524e1e8de31d7d257848e52452631ab4b03f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337686.851032\tC0Uyll3J4MeGnIpKh9\tfe80::c86:954f:5d3e:13c9\t546\tff02::1:2\t547\tudp\t-\t63.002415\t581\t0\tS0\tF\tF\t0\tD\t7\t917\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:51.840Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":570768},"tags":["beats_input_codec_plain_applied"]}

Offset: 666606 Key: Timestamp: 2025-12-10 03:36:52.946 Headers: empty

{"@version":"1","event":{"hash":"bebb6ea6555a242ea4fee892bb3993544bac3cd0423c5381f0bed6a9999b8b24"},"ecs":{"version":"1.6.0"},"message":"1765337810.878438\tCGYDgJ2uk5UsSQmPQ3\t172.30.1.12\t57377\t8.8.8.8\t53\tudp\t55473\t0.027407\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t22.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:52.363Z","host":{"name":"f6b540842a86"},"log":{"offset":573093,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666607 Key: Timestamp: 2025-12-10 03:36:52.946 Headers: empty

{"@version":"1","event":{"hash":"1b2f8112b7234673cc1b4a7ccb82a0f1a48b2deab27c2b5af605fdfc17e4bada"},"ecs":{"version":"1.6.0"},"message":"1765337805.081710\tCgzi5I3YEm1dPGtfyg\t202.46.62.28\t39424\t172.30.1.2\t80\t1\tGET\tsscweb.dyndns.info\t/index.php?smsite=fxqd&smid=16479&smtemp=anagawa\t-\t1.1\tMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.141 Safari/537.36\t-\t0\t266\t302\tFound\t-\t-\t(empty)\t-\t-\t-\t-\t-\t-\tFY8inm2QdDEk3fJ1af\t-\ttext/html","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:52.731Z","host":{"name":"f6b540842a86"},"log":{"offset":22956,"file":{"path":"/usr/share/filebeat/logs/http.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666608 Key: Timestamp: 2025-12-10 03:36:52.947 Headers: empty

{"@version":"1","event":{"hash":"be8ae853b7e2a5e1f6285518fe4df2e2b374afd82629b57b49b9656c72242c8b"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337800.498142\tC9BCs63PU2ddaoQnC4\t172.30.1.12\t52150\t8.8.8.8\t53\tudp\tdns\t0.028777\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:51.840Z","host":{"name":"f6b540842a86"},"log":{"offset":571043,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666609 Key: Timestamp: 2025-12-10 03:36:54.467 Headers: empty

{"@version":"1","event":{"hash":"fa2d9c00bbb226c292cdb42f5f728d0ebbe349b2b342e7afe629c407dae90577"},"ecs":{"version":"1.6.0"},"message":"1765337811.551111\tCbZ0CukZmh9upH56a\t172.30.1.35\t59083\t172.30.1.254\t53\tudp\t28947\t0.495297\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t1152.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:53.363Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":573610},"tags":["beats_input_codec_plain_applied"]}

Offset: 666610 Key: Timestamp: 2025-12-10 03:36:54.467 Headers: empty

{"@version":"1","event":{"hash":"e9457b1ce992b6cca39c4fb2d95c736d216fe6c211399224847a07c6b209e712"},"ecs":{"version":"1.6.0"},"message":"1765337811.908240\tCzf3mEzTzrH2i8W3c\t172.30.1.12\t47238\t8.8.8.8\t53\tudp\t55474\t0.029741\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t107.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:53.363Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":573267},"tags":["beats_input_codec_plain_applied"]}

Offset: 666611 Key: Timestamp: 2025-12-10 03:36:54.467 Headers: empty

{"@version":"1","event":{"hash":"6cad1bc6ecdfadf3d94a0a5c784b766af8eebaddcc7163878bde6d75cd9fdc36"},"ecs":{"version":"1.6.0"},"message":"1765337811.600585\tC6McMk1r1lvzcCo1fi\t172.30.1.35\t59083\t8.8.8.8\t53\tudp\t28947\t0.019441\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2558.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:53.363Z","host":{"name":"f6b540842a86"},"log":{"offset":573441,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666612 Key: Timestamp: 2025-12-10 03:36:55.467 Headers: empty

{"@version":"1","event":{"hash":"591eca853b42e2bf471ec426d330863b8d62ab0688149f44d846127e6e9851f8"},"ecs":{"version":"1.6.0"},"message":"1765337812.948229\tCQ6vdv1RWADceDSEv6\t172.30.1.12\t35992\t8.8.8.8\t53\tudp\t55475\t0.028858\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t106.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:54.364Z","host":{"name":"f6b540842a86"},"log":{"offset":573783,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666613 Key: Timestamp: 2025-12-10 03:36:55.467 Headers: empty

{"@version":"1","event":{"hash":"fac9838e71c08097516fa25ffcaf9ab410ad298b40b22e043df7cdefb54d18d1"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337801.538164\tCxdcwu00ti3Xg0Um5\t172.30.1.12\t33077\t8.8.8.8\t53\tudp\tdns\t0.029119\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:54.840Z","host":{"name":"f6b540842a86"},"log":{"offset":571167,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666614 Key: Timestamp: 2025-12-10 03:36:55.467 Headers: empty

{"@version":"1","event":{"hash":"92928060816988164960f82346e7cfb85c135154290ddd96b4691bec985ae504"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337791.548678\tCmJcUr3xrMHbzgssNl\t172.30.1.35\t56478\t172.30.1.254\t53\tudp\tdns\t1.527395\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:54.840Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":571420},"tags":["beats_input_codec_plain_applied"]}

Offset: 666615 Key: Timestamp: 2025-12-10 03:36:55.467 Headers: empty

{"@version":"1","event":{"hash":"700e84e523a495ef90ec0afc45190cf4dafeb9915d089eb4e806e08c2b7e4618"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337801.557157\tCsMwzt3D18taQxfZr\t172.30.1.35\t50410\t172.30.1.254\t53\tudp\tdns\t0.004637\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:54.840Z","host":{"name":"f6b540842a86"},"log":{"offset":571290,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666616 Key: Timestamp: 2025-12-10 03:36:55.467 Headers: empty

{"@version":"1","event":{"hash":"d059910391026c5565d9cc0f5c5b2835b32ec6c09a8a99fddcba549602da7da9"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337802.578148\tC9X3l61KLCaVzlFJMd\t172.30.1.12\t44608\t8.8.8.8\t53\tudp\tdns\t0.026952\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:54.840Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":571551},"tags":["beats_input_codec_plain_applied"]}

Offset: 666617 Key: Timestamp: 2025-12-10 03:36:56.469 Headers: empty

{"@version":"1","event":{"hash":"cfbb099f2c7507157483a9a1137406942c0ef8fc741199c6465a1c0111640884"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337803.608445\tC66buE1OZWUP1Khjka\t172.30.1.12\t53738\t8.8.8.8\t53\tudp\tdns\t0.026913\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:55.841Z","host":{"name":"f6b540842a86"},"log":{"offset":571675,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666618 Key: Timestamp: 2025-12-10 03:36:56.469 Headers: empty

{"@version":"1","event":{"hash":"193680f763ff38f84fe18fec33b604a5dc95b110e7b9b30a669d32dee6e87c6a"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337804.638240\tC3g7Rh3lojAWI7eLn8\t172.30.1.12\t58568\t8.8.8.8\t53\tudp\tdns\t0.028341\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:55.841Z","host":{"name":"f6b540842a86"},"log":{"offset":571799,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666619 Key: Timestamp: 2025-12-10 03:36:56.469 Headers: empty

{"@version":"1","event":{"hash":"4b12b65207558c6707ed61482fc7e6515a673ba2db9dcc9eec45f864caf0ddca"},"ecs":{"version":"1.6.0"},"message":"1765337813.988238\tCNU8dnLFdiLCvwXJd\t172.30.1.12\t38415\t8.8.8.8\t53\tudp\t55476\t0.028878\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t54.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:55.364Z","host":{"name":"f6b540842a86"},"log":{"offset":573958,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666620 Key: Timestamp: 2025-12-10 03:36:57.470 Headers: empty

{"@version":"1","event":{"hash":"0262a1833e6a2a432e86c4b44b17bbe10e599ffc67fcace0a464300008f45556"},"ecs":{"version":"1.6.0"},"message":"1765337815.028301\tCFpwLi2Y5OT40lZbAd\t172.30.1.12\t57385\t8.8.8.8\t53\tudp\t55477\t0.028005\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t53.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:56.367Z","host":{"name":"f6b540842a86"},"log":{"offset":574131,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666621 Key: Timestamp: 2025-12-10 03:36:57.470 Headers: empty

{"@version":"1","event":{"hash":"a5bf2fabe1fb645435d60c478c489351eb136601b7d2da98a65ceba0d66a09f2"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337751.532402\tCNfSEb276V9jJtaSc3\t172.30.1.222\t64609\t239.255.255.250\t1900\tudp\t-\t3.012501\t700\t0\tS0\tT\tF\t0\tD\t4\t812\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:56.841Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":571923},"tags":["beats_input_codec_plain_applied"]}

Offset: 666622 Key: Timestamp: 2025-12-10 03:36:57.470 Headers: empty

{"@version":"1","event":{"hash":"53954877b3f1e4a7ee46e752209489f3701a41ca30f0f0122e24712277a2f707"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337805.678494\tCnrPa01YbLx4Nd81Ed\t172.30.1.12\t57057\t8.8.8.8\t53\tudp\tdns\t0.028911\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:56.841Z","host":{"name":"f6b540842a86"},"log":{"offset":572055,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666623 Key: Timestamp: 2025-12-10 03:36:58.470 Headers: empty

{"@version":"1","event":{"hash":"d7a3ee33249cd5b55c1e151653ce923ea639a916b7c8d498b0a80fa0a6359903"},"ecs":{"version":"1.6.0"},"message":"1765337816.593264\tCdbFkb1Lh3shcK6qK6\t172.30.1.35\t59811\t8.8.8.8\t53\tudp\t19321\t0.027592\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t528.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:57.367Z","host":{"name":"f6b540842a86"},"log":{"offset":574473,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666624 Key: Timestamp: 2025-12-10 03:36:58.470 Headers: empty

{"@version":"1","event":{"hash":"3a151f8e05305284f4ee1bb28875597068a0e587d6c23356c11b847fab97c43b"},"ecs":{"version":"1.6.0"},"message":"1765337816.123700\tCk6RbH2AJ1xhwrifrg\t172.30.1.12\t42503\t8.8.8.8\t53\tudp\t55478\t-\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t102.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:57.367Z","host":{"name":"f6b540842a86"},"log":{"offset":574305,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666625 Key: Timestamp: 2025-12-10 03:36:58.470 Headers: empty

{"@version":"1","event":{"hash":"fd78685cd99265196fc2dbfa5c5321ecfdfc42bde4156acda5e67c486ac607ac"},"ecs":{"version":"1.6.0"},"message":"1765337816.468263\tCMmfVa16dc276L1Iyh\t172.30.1.35\t59120\t8.8.8.8\t53\tudp\t24671\t-\tapi.intelsa.intel.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:57.367Z","host":{"name":"f6b540842a86"},"log":{"offset":574641,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666626 Key: Timestamp: 2025-12-10 03:36:58.470 Headers: empty

{"@version":"1","event":{"hash":"096bfd82a67beb643245910687fd320079de55d13c0ec506952e72d19ecb76e5"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337811.047012\tCaNA65OCJNhpMylR8\t172.30.1.63\t35370\t172.30.2.171\t5044\ttcp\t-\t4.101447\t0\t0\tS0\tT\tT\t0\tS\t5\t300\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:57.841Z","host":{"name":"f6b540842a86"},"log":{"offset":572179,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666627 Key: Timestamp: 2025-12-10 03:36:59.471 Headers: empty

{"@version":"1","event":{"hash":"96b617421b25d1c5bf04ba50ae036c5e7248f6db12296aa28265fff956a4784f"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337806.544233\tCimCED3WI45hbrsuOi\t172.30.1.35\t65200\t172.30.1.254\t53\tudp\tdns\t0.025622\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:58.842Z","host":{"name":"f6b540842a86"},"log":{"offset":572304,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666628 Key: Timestamp: 2025-12-10 03:36:59.471 Headers: empty

{"@version":"1","event":{"hash":"13721ea072b586e250bcdf5895016bfec11ad1ff0e487924f698d84d0c6f177c"},"ecs":{"version":"1.6.0"},"message":"1765337817.098454\tCmugt22xjBhWDvpoxk\t172.30.1.12\t47560\t8.8.8.8\t53\tudp\t55479\t0.026424\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t15.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:58.368Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":574785},"tags":["beats_input_codec_plain_applied"]}

Offset: 666629 Key: Timestamp: 2025-12-10 03:36:59.472 Headers: empty

{"@version":"1","event":{"hash":"7afcf909ea890e9ab39895fe916efe28440376cdecd6c34e5a4f2f9b359a508e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337806.718411\tCL8UCD4SS5DLv1D9le\t172.30.1.12\t33319\t8.8.8.8\t53\tudp\tdns\t0.028379\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:58.842Z","host":{"name":"f6b540842a86"},"log":{"offset":572435,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666630 Key: Timestamp: 2025-12-10 03:37:00.472 Headers: empty

{"@version":"1","event":{"hash":"817d142935c540ee9386d915515670f6a96bc8a41d7bc453dab949d10598268f"},"ecs":{"version":"1.6.0"},"message":"1765337816.551364\tCQ5LCpRT4W5hkdHL1\t172.30.1.35\t59811\t172.30.1.254\t53\tudp\t19321\t2.017653\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2650.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:59.368Z","host":{"name":"f6b540842a86"},"log":{"offset":574959,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666631 Key: Timestamp: 2025-12-10 03:37:00.472 Headers: empty

{"@version":"1","event":{"hash":"ddd20b2194e5fe68f2d81add86f556bae92682a18c2b17d59d55747239d1808d"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337812.600460\tCQ74bP3WyKksbmwoH9\t172.30.1.2\t52318\t172.30.4.139\t1514\ttcp\t-\t2.998677\t0\t0\tS0\tT\tT\t0\tS\t3\t180\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:59.842Z","host":{"name":"f6b540842a86"},"log":{"offset":572559,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666632 Key: Timestamp: 2025-12-10 03:37:00.472 Headers: empty

{"@version":"1","event":{"hash":"1ff14c136b9cd8fbf5046e57f3b26bad7b53c5abcbbeeb302e711d2cd718e8e2"},"ecs":{"version":"1.6.0"},"message":"1765337818.128321\tCZSQU34QtJatrvlxW7\t172.30.1.12\t43657\t8.8.8.8\t53\tudp\t55480\t0.027584\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t100.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:59.368Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":575132},"tags":["beats_input_codec_plain_applied"]}

Offset: 666633 Key: Timestamp: 2025-12-10 03:37:00.472 Headers: empty

{"@version":"1","event":{"hash":"c95927f371531d570e74aa950511b3c19be04445dbb9bb5360aa2355dda97dfe"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337807.758309\tCy1DP934y8UhBJCj93\t172.30.1.12\t60634\t8.8.8.8\t53\tudp\tdns\t0.031793\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:59.842Z","host":{"name":"f6b540842a86"},"log":{"offset":572684,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666634 Key: Timestamp: 2025-12-10 03:37:00.472 Headers: empty

{"@version":"1","event":{"hash":"ec13a23b42f0df4fecfe4c3125f2a434590f573bb60ec8b9a3045fbbc5db2653"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337808.798537\tCtEIbQ3DqC3YPP2jji\t172.30.1.12\t45314\t8.8.8.8\t53\tudp\tdns\t0.028895\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:36:59.842Z","host":{"name":"f6b540842a86"},"log":{"offset":572808,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666635 Key: Timestamp: 2025-12-10 03:37:01.472 Headers: empty

{"@version":"1","event":{"hash":"8ec1414bd21287c1a05ebe0ecc91231af2c8da4227e194693e0247ce12cf2814"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337759.279373\tCSFBrUFZgR6x7Den\t172.30.1.132\t3\t8.8.8.8\t3\ticmp\t-\t-\t-\t-\tOTH\tT\tF\t0\t-\t1\t99\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:00.843Z","host":{"name":"f6b540842a86"},"log":{"offset":572932,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666636 Key: Timestamp: 2025-12-10 03:37:01.472 Headers: empty

{"@version":"1","event":{"hash":"9ee910829e8d0a3dfd3afc4fc2d4638279a51fe731e0ebea29aab8b77f08dc47"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337809.838378\tCaqXbfqQM4ojFj57g\t172.30.1.12\t45544\t8.8.8.8\t53\tudp\tdns\t0.028129\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:00.843Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":573039},"tags":["beats_input_codec_plain_applied"]}

Offset: 666637 Key: Timestamp: 2025-12-10 03:37:01.472 Headers: empty

{"@version":"1","event":{"hash":"26f9dd2a7d3b52e6bf17431d6687ef47490d345f11f514ff4beda76e20eb6f0a"},"ecs":{"version":"1.6.0"},"message":"1765337819.158384\tC5790p46UtsyjFPQe1\t172.30.1.12\t46454\t8.8.8.8\t53\tudp\t55481\t0.028800\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t13.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:00.369Z","host":{"name":"f6b540842a86"},"log":{"offset":575456,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666638 Key: Timestamp: 2025-12-10 03:37:01.472 Headers: empty

{"@version":"1","event":{"hash":"73e2ecbb7bc3ae7112ecc0afaf7b080dffb12cead9a75f01c79674a8252e42a0"},"ecs":{"version":"1.6.0"},"message":"1765337816.429280\tCR5jPn2ZufaIs0Exc1\t172.30.1.35\t59120\t172.30.1.254\t53\tudp\t24671\t-\tapi.intelsa.intel.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tF\t0\t-\t-\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:00.369Z","host":{"name":"f6b540842a86"},"log":{"offset":575307,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666639 Key: Timestamp: 2025-12-10 03:37:02.475 Headers: empty

{"@version":"1","event":{"hash":"62943af7c64c7aa5fcfed88791603e7bc650afc26ec0190d7bda691c8cba7022"},"ecs":{"version":"1.6.0"},"message":"1765337820.198351\tCCK2u81o6xFBNbJAn4\t172.30.1.12\t40267\t8.8.8.8\t53\tudp\t55482\t0.027282\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t12.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:01.369Z","host":{"name":"f6b540842a86"},"log":{"offset":575630,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666640 Key: Timestamp: 2025-12-10 03:37:03.473 Headers: empty

{"@version":"1","event":{"hash":"7fdcb4e06e87b96aba52640b3629e1a3086037e70e7b2543e024f1fd0e38b309"},"ecs":{"version":"1.6.0"},"message":"1765337821.621840\tCJv4r43A3aLohvGFH1\t172.30.1.35\t53181\t172.30.1.254\t53\tudp\t14576\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t2645.000000\tF","agent":{"name":"f6b540842a86","id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:02.370Z","host":{"name":"f6b540842a86"},"log":{"offset":575979,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666641 Key: Timestamp: 2025-12-10 03:37:03.473 Headers: empty

{"@version":"1","event":{"hash":"21bb0e87a8c57d87b49ec8a4f064cf7332671f1e8cc1790cf47d4f0c61f074e0"},"ecs":{"version":"1.6.0"},"message":"1765337821.228358\tCJbE734DILiz6npKZj\t172.30.1.12\t33596\t8.8.8.8\t53\tudp\t55483\t0.026769\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t153.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:02.369Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/dns.log"},"offset":575804},"tags":["beats_input_codec_plain_applied"]}

Offset: 666642 Key: Timestamp: 2025-12-10 03:37:04.947 Headers: empty

{"@version":"1","event":{"hash":"bbb4206c7c1c077bc1dc8686bef7bc38e12f36af86a4ae879ba207735628ab47"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337760.422421\tCA6UTr3ypE5pJejaPi\t172.30.1.132\t49395\t216.239.35.12\t123\tudp\tntp\t0.027982\t48\t48\tSF\tT\tF\t0\tDd\t1\t76\t1\t76\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.843Z","host":{"name":"f6b540842a86"},"log":{"offset":573162,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666643 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"e7e706e8de577f3eefa0056dfd30d7ad71e003c0f8785800f121a4248f0dc3d4"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337816.172460\tCtce2E1J7gwznM4rZa\t172.30.1.63\t35370\t172.30.2.171\t5044\ttcp\t-\t2.047999\t0\t0\tS0\tT\tT\t0\tS\t2\t120\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.843Z","host":{"name":"f6b540842a86"},"log":{"offset":573294,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666644 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"53652835fd194f8e6f0d7d2621a3a04cfc4d2bc171211cf7ebe791ec20c6a5a5"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765333828.319772\tCMEsOl1uTxX4HvIsvd\t172.30.1.35\t64609\t40.99.33.178\t443\tudp\t-\t3932.525997\t86209\t110923\tSF\tT\tF\t0\tDd\t515\t100629\t989\t138615\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":573420},"tags":["beats_input_codec_plain_applied"]}

Offset: 666645 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"213caf2d669b8c02743d3950122479a2e057dee0af9d36b554ef2212846981a9"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337816.436904\tCnDTim1mMKEcEsgc1c\t10.10.10.1\t35808\t10.10.10.202\t8000\ttcp\t-\t0.041847\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"offset":573570,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666646 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"6a1e68ca9b477c5bbcfb06d65fb6de97fee50f3ab69cbc04b91dc34c8965bfbd"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337816.478984\tCRYmr42Fpbuhym9D92\t10.10.10.1\t33430\t10.10.10.200\t8000\ttcp\t-\t0.040232\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":573699},"tags":["beats_input_codec_plain_applied"]}

Offset: 666647 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"74a0a948d69704d32fb323d920fd2cec76f15b6ca7ea6e20ee35f3de4a4ec486"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337810.878438\tCGYDgJ2uk5UsSQmPQ3\t172.30.1.12\t57377\t8.8.8.8\t53\tudp\tdns\t0.027407\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"offset":573828,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666648 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"58b25c14251cbd41d7c31863fa18d0e455fe06b9eeaed441bc86ee4ee060f926"},"ecs":{"version":"1.6.0"},"message":"worker-1-1\t1765337811.551111\tCbZ0CukZmh9upH56a\t172.30.1.35\t59083\t172.30.1.254\t53\tudp\tdns\t0.495297\t31\t129\tSF\tT\tT\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":573952},"tags":["beats_input_codec_plain_applied"]}

Offset: 666649 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"fde810b3e71bd00f474351a6e9d7eadea6362cc07a6128c23e3c8ffc26c2bf0c"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337816.519487\tCyhTrz1I57RxmfhS78\t10.10.10.1\t49118\t10.10.10.201\t8000\ttcp\t-\t0.063893\t56\t0\tSH\tT\tT\t0\tSADF\t6\t376\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":574082},"tags":["beats_input_codec_plain_applied"]}

Offset: 666650 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"8d07a75814d214283110b48a76eb116cf2be5cda9abf396cfebc936865e38430"},"ecs":{"version":"1.6.0"},"message":"worker-1-3\t1765337816.577638\tCiHNzZSqWDAEzwdhc\t10.10.10.1\t33230\t10.10.10.203\t8000\ttcp\t-\t0.104482\t56\t0\tSH\tT\tT\t0\tSADF\t5\t324\t0\t0\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":574211},"tags":["beats_input_codec_plain_applied"]}

Offset: 666651 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"a55e8cdfffd75af475a5bcf17d0d5d506f304fe2b6eeeb36ff81a14af2c3ad15"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765337811.908240\tCzf3mEzTzrH2i8W3c\t172.30.1.12\t47238\t8.8.8.8\t53\tudp\tdns\t0.029741\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"offset":574339,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666652 Key: Timestamp: 2025-12-10 03:37:04.948 Headers: empty

{"@version":"1","event":{"hash":"141932055f42ede5d95cb47bbeae4c8781e78f5fd07372022e10ca815408f8fd"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765337811.591641\tC6McMk1r1lvzcCo1fi\t172.30.1.35\t59083\t8.8.8.8\t53\tudp\tdns\t0.028385\t31\t129\tSF\tT\tF\t0\tDd\t1\t59\t1\t157\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:37:03.844Z","host":{"name":"f6b540842a86"},"log":{"offset":574462,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666653 Key: Timestamp: 2025-12-10 03:55:34.500 Headers: empty

{"@version":"1","event":{"hash":"ba7d6376e7e71d4e163a4d73b46bd3c5903191cafb96d46744bb3826b736ffea"},"ecs":{"version":"1.6.0"},"message":"1765338931.939106\tCSotv71fepAu0D4fpe\t172.30.1.12\t42348\t8.8.8.8\t53\tudp\t56568\t0.026723\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t138.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:55:33.393Z","host":{"name":"f6b540842a86"},"log":{"offset":846550,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666654 Key: Timestamp: 2025-12-10 03:55:34.500 Headers: empty

{"@version":"1","event":{"hash":"342cfa581bda97a22d86d975b1e0debfaa5d4cb98eeb320cdbfc89c168586991"},"ecs":{"version":"1.6.0"},"message":"worker-1-2\t1765338922.599031\tC2OXny3CqhExItNBB\t172.30.1.12\t44624\t8.8.8.8\t53\tudp\tdns\t0.027728\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:55:33.910Z","host":{"name":"f6b540842a86"},"log":{"offset":850838,"file":{"path":"/usr/share/filebeat/logs/conn.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666655 Key: Timestamp: 2025-12-10 03:55:34.500 Headers: empty

{"@version":"1","event":{"hash":"5ef036843bf8e84ac3f88bba5e7673ddcc0d019da50b653b6a29672561859dc4"},"ecs":{"version":"1.6.0"},"message":"1765338931.647306\tCqIdzxujf1STBcJBg\t172.30.1.35\t53002\t8.8.8.8\t53\tudp\t35628\t-\tg.ceipmsn.com\t1\tC_INTERNET\t1\tA\t3\tNXDOMAIN\tF\tF\tT\tT\t0\tg.search.live.com\t3013.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:55:33.393Z","host":{"name":"f6b540842a86"},"log":{"offset":846725,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666656 Key: Timestamp: 2025-12-10 03:55:35.501 Headers: empty

{"@version":"1","event":{"hash":"e04b52d495ffca3891321759867ac618c57d0efa75d56b4b42cb2e3008e13c72"},"ecs":{"version":"1.6.0"},"message":"1765338932.969214\tCJAU2q3G6yN5jFrL5a\t172.30.1.12\t49188\t8.8.8.8\t53\tudp\t56569\t0.050685\ttr069ap.trueinternet.co.th\t1\tC_INTERNET\t1\tA\t0\tNOERROR\tF\tF\tT\tT\t0\t61.90.207.93\t137.000000\tF","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:55:34.397Z","host":{"name":"f6b540842a86"},"log":{"offset":846886,"file":{"path":"/usr/share/filebeat/logs/dns.log"}},"tags":["beats_input_codec_plain_applied"]}

Offset: 666657 Key: Timestamp: 2025-12-10 03:55:35.501 Headers: empty

{"@version":"1","event":{"hash":"8d2d141b1195d20e511a2fc157b6c8b971955c0b560bc617b2d369234eafcc1e"},"ecs":{"version":"1.6.0"},"message":"worker-1-4\t1765338923.629174\tCs8kBx15ZqTOvqkKji\t172.30.1.12\t40807\t8.8.8.8\t53\tudp\tdns\t0.026819\t44\t60\tSF\tT\tF\t0\tDd\t1\t72\t1\t88\t-","agent":{"id":"2dc44db8-0e86-4f9c-be47-40bc8f117d50","name":"f6b540842a86","ephemeral_id":"f9ba3ad4-d565-497c-ae69-be9c7212d3d7","hostname":"f6b540842a86","version":"7.10.2","type":"filebeat"},"input":{"type":"log"},"type":"network","@timestamp":"2025-12-10T03:55:34.910Z","host":{"name":"f6b540842a86"},"log":{"file":{"path":"/usr/share/filebeat/logs/conn.log"},"offset":850961},"tags":["beats_input_codec_plain_applied"]}

Kafdrop

Topic Messages: logstash-local-network