# Packet Beat not sending any data

**URL:** https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868
**Category:** Beats
**Tags:** packetbeat
**Created:** [November 6, 2019, 10:22pm UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868 "2019-11-06T22:22:15Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Mhodge13](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@Mhodge13](https://discuss.elastic.co/u/Mhodge13)
#### Post date: [November 6, 2019, 10:22pm UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868/1 "2019-11-06T22:22:15Z")

</div>

Hi,

Started noticing issues today with packet beat not sending any data to our elasticsearch SIEM. I started debug logging and found this constantly happening.

| 2019-11-06T16:15:10.000-0600 | DEBUG | [flows] | flows/worker.go:121 | worker tick, nTimeout=2, nPeriod=0 |
| --- | --- | --- | --- | --- |
| 2019-11-06T16:15:10.000-0600 | DEBUG | [flows] | flows/worker.go:143 | exec tick, timeout=false, report=true |
| 2019-11-06T16:15:10.071-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:10.571-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:11.071-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:11.571-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:12.072-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:12.573-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:13.088-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:13.590-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |
| 2019-11-06T16:15:14.105-0600 | DEBUG | [sniffer] | sniffer/sniffer.go:185 | Interrupted |

Including config file blow:  
#============================== Network device ================================

# Select the network interface to sniff the data. On Linux, you can use the

# "any" keyword to sniff on all connected interfaces.

packetbeat.interfaces.device: 0

#================================== Flows =====================================

# Set `enabled: false` or comment out all options to disable flows reporting.

packetbeat.flows:

# Set network flow timeout. Flow is killed if no packet is received before being

# timed out.

timeout: 30s

enabled: true

# Configure reporting period. If set to -1, only killed flows will be reported

period: 10s

#========================== Transaction protocols =============================

packetbeat.protocols:

- type: icmp

- type: amqp

- type: cassandra  
#Cassandra port for traffic monitoring.  
ports: [9042]

- type: dhcpv4

- type: dns

- type: http

- type: memcache

- type: mysql

- type: pgsql

- type: redis

- type: thrift

- type: mongodb

- type: nfs

- type: tls

#==================== Elasticsearch template setting ==========================

setup.template.settings:  
index.number\_of\_shards: 1  
#index.codec: best\_compression  
#\_source.enabled: false

#================================ Logging =====================================

# Sets log level. The default log level is info.

# Available log levels are: error, warning, info, debug

logging.to\_files: true  
logging.level: debug

logging.files:  
path: C:\Program Files\packetbeat\Logs  
name: packetbeat  
keepfiles: 7  
permissions: 0644

---

<div class="post-metadata">

### Author: ![SRS1](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@SRS1](https://discuss.elastic.co/u/SRS1)
#### Post date: [November 19, 2019, 10:16am UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868/2 "2019-11-19T10:16:50Z")

</div>

I have two packetbeats running im my system, and one of them are seeing this issue. (The other one works well)

The only difference is that logstash is located on the localhost on one of them, the other one is remote.

---

<div class="post-metadata">

### Author: ![SRS1](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@SRS1](https://discuss.elastic.co/u/SRS1)
#### Post date: [November 19, 2019, 10:24am UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868/3 "2019-11-19T10:24:51Z")

</div>

And my stupidity is confirmed!

Use the packetbeat.exe device - and change the number accordingly! (....as stated in the user guide)

---

<div class="post-metadata">

### Author: ![Mhodge13](https://avatars.discourse-cdn.com/v4/letter/m/9dc877/32.png) [@Mhodge13](https://discuss.elastic.co/u/Mhodge13)
#### Post date: [November 19, 2019, 11:39am UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868/4 "2019-11-19T11:39:59Z")

</div>

I'll give this a shot.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2019, 11:40am UTC](https://discuss.elastic.co/t/packet-beat-not-sending-any-data/206868/5 "2019-12-17T11:40:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
