# Decreasing total

**URL:** <https://discuss.elastic.co/t/decreasing-total/189575>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [July 9, 2019, 3:09pm UTC](https://discuss.elastic.co/t/decreasing-total/189575 "2019-07-09T15:09:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lasselj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lasselj/32/49763_2.png) [@lasselj](https://discuss.elastic.co/u/lasselj)\
**Post date:** [July 9, 2019, 3:09pm UTC](https://discuss.elastic.co/t/decreasing-total/189575/1 "2019-07-09T15:09:13Z")

</div>

How does it happen that the packetbeat metric dest.stats.net\_bytes\_total (or in some cases source.stats.net\_bytes\_total) is not monotonic within a particular flow over time?

I.e. this looks weird:

 ![00](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a4ef1eb2c48b959e1d616151555d318215e3ef4.png) ![05](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e24a28aef090f56cf7052d29f6352ceff5f684a2.png) ![12](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a78faaaa23fb938da15291b1077d48ed22dfe79c.png)

---

<div class="post-metadata">

**Author:** ![lasselj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lasselj/32/49763_2.png) [@lasselj](https://discuss.elastic.co/u/lasselj)\
**Post date:** [July 10, 2019, 8:24am UTC](https://discuss.elastic.co/t/decreasing-total/189575/2 "2019-07-10T08:24:36Z")

</div>

This feels like a bug. Does anyone from the Beats team want to comment?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 10, 2019, 1:32pm UTC](https://discuss.elastic.co/t/decreasing-total/189575/3 "2019-07-10T13:32:25Z")

</div>

Flows work at the packet level and are not aware of connections. For this reasons flow must time out in order to not leak memory. Normally the `flow.final` field is set in this case. The default timeout is 30s. The scrneeshot shows that numbers didn't change in the last few documents before the 'reset'.

You can increase the timeout via `packetbeat.flows.timeout`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2019, 1:32pm UTC](https://discuss.elastic.co/t/decreasing-total/189575/4 "2019-08-07T13:32:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.