Hey @learner the source.state.net_bytes_total that you're seeing is coming from the document that is indexed into Elasticsearch, you have multiple documents in Elasticsearch and each of them have that net_bytes_total field.
Yeah, apparently those search results are coming from ES but do you know of any source document where it explains why ES gets multiple documents for a single file transfer instead of just once when it gets completed?
Yup @learner, it's constantly sampling and writing documents to Elasticsearch. Packetbeat doesn't know about the files that are being downloaded themselves, but instead it's logged the total packets being sent over your network connection.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.