# Huge packets sent from filebeat to ES

**URL:** <https://discuss.elastic.co/t/huge-packets-sent-from-filebeat-to-es/345343>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 19, 2023, 2:34am UTC](https://discuss.elastic.co/t/huge-packets-sent-from-filebeat-to-es/345343 "2023-10-19T02:34:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Post date:** [October 19, 2023, 2:34am UTC](https://discuss.elastic.co/t/huge-packets-sent-from-filebeat-to-es/345343/1 "2023-10-19T02:34:56Z")

</div>

Hi all,

I'm using the netflow module on filebeat v8.8.0 to send netflow traffic to ES. The incoming netflow packets are all about 5KB to 6KB. When I did a tcpdump on the interface that is sending the netflow data to ES, I noticed that a lot of the outgoing packets are 64KB.

Is this normal? Is there some sort of data buffering before sending it out to ES to result in the large packets?

I did have the following settings in my filebeat config:

```auto
queue.mem.events: 64000
queue.mem.flush.min_events: 4000
output.elasticsearch.bulk_max_size: 4000

```

and in the `netflow.yml`:

`queue_size: 64000`

I'm currently trying to improve the ingest rate and reduce the packet drop reported by filebeat, hence, I'm wondering if there might be any bottleneck in the network.

Thank you.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [October 19, 2023, 11:49am UTC](https://discuss.elastic.co/t/huge-packets-sent-from-filebeat-to-es/345343/2 "2023-10-19T11:49:02Z")

</div>

Yes, filebeat "collects" events to bulk ingest them. There is some compression etc.  
Ingests tend to use the bulk api's to improve throughput.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2023, 1:49pm UTC](https://discuss.elastic.co/t/huge-packets-sent-from-filebeat-to-es/345343/3 "2023-11-16T13:49:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.