# Logstash Tshark issue

**URL:** <https://discuss.elastic.co/t/logstash-tshark-issue/118582>\
**Category:** Logstash\
**Created:** [February 6, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-tshark-issue/118582 "2018-02-06T08:51:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hsiuming](https://avatars.discourse-cdn.com/v4/letter/h/d78d45/32.png) [@hsiuming](https://discuss.elastic.co/u/hsiuming)\
**Post date:** [February 6, 2018, 8:51am UTC](https://discuss.elastic.co/t/logstash-tshark-issue/118582/1 "2018-02-06T08:51:47Z")

</div>

Hello ,We now get a network package data by tshark.

We send these data to elasticsearch system with the step:

1. get the package data and convert it to json file : tshark -i eth0 ... -T ek \> packets.json

2. send this data to logstash by filebeat.

3. Create a data table to analyze these data.

In this table we have to know the previous relative time data.

So we coding the logstash ruby code to do it.

The ruby code is:

ruby {  
init =\> "@@count = 0 "  
code =\> "  
event.set('[test]', @@count)  
@@count = event.get('[layers][frame\_time\_relative]')  
"  
}

The last time data in the "test"column.

And the table is:  
 ![%E6%9C%AA%E5%91%BD%E5%90%8D](https://us1.discourse-cdn.com/elastic/original/3X/3/4/349ff3f7635d982b3a0840bdbcf7de42c223d989.png)

We find the test column has the wrong position in data table.

I have no idea what caused it.

I think that maybe, it is multi-thread issue.

Is it possible to set mutex in logstash ruby code?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 8:52am UTC](https://discuss.elastic.co/t/logstash-tshark-issue/118582/2 "2018-03-06T08:52:00Z")

</div>

Closed on March 6, 2018, 8:52am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.