# File copy size that appears multiple times **URL:** \ **Category:** Kibana\ **Created:** [January 10, 2018, 6:48pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931 "2018-01-10T18:48:24Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\ **Post date:** [January 10, 2018, 6:48pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/1 "2018-01-10T18:48:24Z")
I downloaded a 2.4 GB file from the Internet and the same 2.4 GB size appears multiple times in my query result, as below. Is this normal? Why does ES show the total size multiple times rather than just once at the end of the download? My query: `dest.ip:10.10.243.236 AND source.stats.net_bytes_total:>2590000000` ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/5/55d8e4cff7165ae4b5de87271504ac553743a896.png) Thanks. - Young ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [January 12, 2018, 8:03pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/2 "2018-01-12T20:03:59Z")
Hey @learner the `source.state.net_bytes_total` that you're seeing is coming from the document that is indexed into Elasticsearch, you have multiple documents in Elasticsearch and each of them have that `net_bytes_total` field. ---
**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\ **Post date:** [January 12, 2018, 8:56pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/3 "2018-01-12T20:56:46Z")
Hi Brandon, Yeah, apparently those search results are coming from ES but do you know of any source document where it explains why ES gets multiple documents for a single file transfer instead of just once when it gets completed? Thank you for your help!!! - Young ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [January 12, 2018, 8:57pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/4 "2018-01-12T20:57:40Z")
@learner how are you indexing your documents in Elasticsearch? Are you using Logstash, Beats or the Ingest Node? ---
**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\ **Post date:** [January 12, 2018, 8:58pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/5 "2018-01-12T20:58:41Z")
Hi Brandon, I'm using Packetbeat for ES indexing. Thanks. - Young ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [January 12, 2018, 9:00pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/6 "2018-01-12T21:00:36Z")
Ah... Packetbeat's `net_bytes_total` is an always increasing value that is the total bytes that have been transferred over your network connection. ---
**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\ **Post date:** [January 12, 2018, 9:03pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/7 "2018-01-12T21:03:02Z")
OK, my searches came up with progressed sizes during the transfer, which made sense, but I was expecting just one final document when it's completed. I guess it creates multiple documents in microscopic intervals while it's wrapping up the completion. Thank you! - Young ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [January 12, 2018, 9:04pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/8 "2018-01-12T21:04:34Z")
Yup @learner, it's constantly sampling and writing documents to Elasticsearch. Packetbeat doesn't know about the files that are being downloaded themselves, but instead it's logged the total packets being sent over your network connection. ---
**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\ **Post date:** [January 12, 2018, 9:05pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/9 "2018-01-12T21:05:33Z")
I got it now. Thank you very much for the helpful responses and explanations, Brandon!!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2018, 9:06pm UTC](https://discuss.elastic.co/t/file-copy-size-that-appears-multiple-times/114931/10 "2018-02-09T21:06:01Z")
Closed on February 9, 2018, 9:06pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.