# PacketBeat doesn't reflect the real flow data **URL:** \ **Category:** Kibana\ **Created:** [March 31, 2018, 10:39am UTC](https://discuss.elastic.co/t/packetbeat-doesnt-reflect-the-real-flow-data/126313 "2018-03-31T10:39:19Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [March 31, 2018, 10:39am UTC](https://discuss.elastic.co/t/packetbeat-doesnt-reflect-the-real-flow-data/126313/1 "2018-03-31T10:39:19Z")
Hi, after following the reference to install and run PacketBeat, I found the dashboard doesn't reflect the real condition. The dashboard has only few data. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e955f99dfa7f2936c137e226755f893a02568be.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a123452b7151191142781c15c0711675b169f51.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d64565b9b9b7c72d762a67e4458585e28b5e3824.png) (I use logstash ingest netflow and export flow to ES, but the packetbeat only has few flows.) My OS is windows. this is the packetbeat.yml ``` #################### Packetbeat Configuration Example ######################### #============================== Network device ================================ # Select the network interface to sniff the data. On Linux, you can use the # "any" keyword to sniff on all connected interfaces. packetbeat.interfaces.device: 0 #================================== Flows ===================================== # Set `enabled: false` or comment out all options to disable flows reporting. packetbeat.flows: # Set network flow timeout. Flow is killed if no packet is received before being # timed out. timeout: 30s # Configure reporting period. If set to -1, only killed flows will be reported period: 10s #========================== Transaction protocols ============================= packetbeat.protocols: - type: icmp # Enable ICMPv4 and ICMPv6 monitoring. Default: false enabled: true - type: amqp # Configure the ports where to listen for AMQP traffic. You can disable # the AMQP protocol by commenting out the list of ports. ports: [5672] - type: cassandra #Cassandra port for traffic monitoring. ports: [9042] - type: dns # Configure the ports where to listen for DNS traffic. You can disable # the DNS protocol by commenting out the list of ports. ports: [53] # include_authorities controls whether or not the dns.authorities field # (authority resource records) is added to messages. include_authorities: true # include_additionals controls whether or not the dns.additionals field # (additional resource records) is added to messages. include_additionals: true - type: http # Configure the ports where to listen for HTTP traffic. You can disable # the HTTP protocol by commenting out the list of ports. ports: [80, 8080, 8000, 5000, 8002] - type: memcache # Configure the ports where to listen for memcache traffic. You can disable # the Memcache protocol by commenting out the list of ports. ports: [11211] - type: mysql # Configure the ports where to listen for MySQL traffic. You can disable # the MySQL protocol by commenting out the list of ports. ports: [3306] - type: pgsql # Configure the ports where to listen for Pgsql traffic. You can disable # the Pgsql protocol by commenting out the list of ports. ports: [5432] - type: redis # Configure the ports where to listen for Redis traffic. You can disable # the Redis protocol by commenting out the list of ports. ports: [6379] - type: thrift # Configure the ports where to listen for Thrift-RPC traffic. You can disable # the Thrift-RPC protocol by commenting out the list of ports. ports: [9090] - type: mongodb # Configure the ports where to listen for MongoDB traffic. You can disable # the MongoDB protocol by commenting out the list of ports. ports: [27017] - type: nfs # Configure the ports where to listen for NFS traffic. You can disable # the NFS protocol by commenting out the list of ports. ports: [2049] - type: tls # Configure the ports where to listen for TLS traffic. You can disable # the TLS protocol by commenting out the list of ports. ports: [443] #==================== Elasticsearch template setting ========================== setup.template.settings: index.number_of_shards: 3 #index.codec: best_compression #_source.enabled: false #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. #name: # The tags of the shipper are included in their own field with each # transaction published. #tags: ["service-X", "web-tier"] # Optional fields that you can specify to add additional information to the # output. #fields: # env: staging #============================== Dashboards ===================================== # These settings control loading the sample dashboards to the Kibana index. Loading # the dashboards is disabled by default and can be enabled either by setting the # options here, or by using the `-setup` CLI flag or the `setup` command. #setup.dashboards.enabled: false # The URL from where to download the dashboards archive. By default this URL # has a value which is computed based on the Beat name and version. For released # versions, this URL points to the dashboard archive on the artifacts.elastic.co # website. #setup.dashboards.url: #============================== Kibana ===================================== # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API. # This requires a Kibana endpoint configuration. setup.kibana: # Kibana Host # Scheme and port can be left out and will be set to the default (http and 5601) # In case you specify and additional path, the scheme is required: http://localhost:5601/path # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 #host: "localhost:5601 #================================ Outputs ===================================== # Configure what output to use when sending the data collected by the beat. #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: # Array of hosts to connect to. hosts: ["120.127.160.91:9200"] # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "elastic" #----------------------------- Logstash output -------------------------------- #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" ``` what wrong with it? thank you in advance! ---
**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\ **Post date:** [April 4, 2018, 3:39am UTC](https://discuss.elastic.co/t/packetbeat-doesnt-reflect-the-real-flow-data/126313/2 "2018-04-04T03:39:13Z")
> [@f26227279](#): > > (I use logstash ingest netflow and export flow to ES, but the packetbeat only has few flows.) Your Packetbeat.yml looks right to me . Can you increase the timespan to a greater value and re-check again ? Was there a glitch in traffic anytime ? Logs would help too. Which version are you using ? Cheers Rashmi ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 2, 2018, 3:39am UTC](https://discuss.elastic.co/t/packetbeat-doesnt-reflect-the-real-flow-data/126313/3 "2018-05-02T03:39:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.