# Final=true filter vs. traffic data discrepancy

**URL:** <https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767>\
**Category:** Kibana\
**Created:** [January 9, 2018, 10:55pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767 "2018-01-09T22:55:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\
**Post date:** [January 9, 2018, 10:55pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767/1 "2018-01-09T22:55:11Z")

</div>

Hi,

I'm using Packetbeat to capture traffic between hosts, as below, with the filter **"final=true".**

Just downloaded a 2.4 GB file and it indeed appeared in my query for the last 15m, which is good.

But, if I query for the last 4h, my entry does not show up at all any longer, while other hosts that transferred only 500MB, 100MB, etc. appear during the last 4h.

What I expected was to see my entry appearing in 15m, 30m, 1h, and even in 4h, because my 2.4 GB download is supposed to be the heaviest traffic for the last 4h.

Could an expert please explain this behavior so that it'd make sense?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5ad2e90486363c70a575a09cda6752db426e972.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b5ea1fded2e6ec1dd5b3635b6c476bf20ccd4c62.png)

Thanks.

- Young

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 10, 2018, 12:16pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767/2 "2018-01-10T12:16:14Z")

</div>

So your capturing flow information only?

Obviously the data are available in Elasticsearch. Don't think this is related to beats, but some filters/configs in Kibana.

In kibana 1. use the discovery tool, 2. set time-range that contains your download 3. open one document and select some fields to create a tabular overview (include source.stats.net\_bytes\_total in this list). 4. Use tabular view to sort entries by size -\> entry should be shown.

---

<div class="post-metadata">

**Author:** ![learner](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@learner](https://discuss.elastic.co/u/learner)\
**Post date:** [January 10, 2018, 5:26pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767/3 "2018-01-10T17:26:23Z")

</div>

Hi Steffen,

I'm trying to see all the data points from 4h ago through now in Kibana by default, not by each time manual configuration change.

So that my data point from 5m ago still appears in my query for 12h, if that data point is high in the rank?

Maybe, Is it possible to do it by changing some option under Management \> Advanced Settings?

Thanks.

- Young

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 11, 2018, 1:07pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767/4 "2018-01-11T13:07:55Z")

</div>

I moved the topic to the Kibana forum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2018, 10:55pm UTC](https://discuss.elastic.co/t/final-true-filter-vs-traffic-data-discrepancy/114767/6 "2018-01-30T22:55:41Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.