# Packetbeat performance
**URL:** https://discuss.elastic.co/t/packetbeat-performance/46834
**Category:** Beats
**Tags:** packetbeat
**Created:** [April 8, 2016, 4:49pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834 "2016-04-08T16:49:32Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ada\_pozo](https://discuss.elastic.co/u/ada_pozo)
#### Post date: [April 8, 2016, 4:49pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/1 "2016-04-08T16:49:32Z")
Hi,
I'm looking into how many packets can packetbeat capture before it starts dropping them doing tcpreplay in loopback, With speeds up to 1 Gbps I only get approximately 50 packets per second. Is this normal? Is there any way to get better results? I am using af\_packet with a 500 Mb buffer.
Ada
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 8, 2016, 9:18pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/2 "2016-04-08T21:18:41Z")
50 pps sounds crazy low. Which packetbeat version are you testing?
---
### Author:  [@ada\_pozo](https://discuss.elastic.co/u/ada_pozo)
#### Post date: [April 9, 2016, 11:01am UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/3 "2016-04-09T11:01:23Z")
Latest version, 1.2
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 11, 2016, 11:26am UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/4 "2016-04-11T11:26:41Z")
You run linux in VM?
How can you tell ~50 pps are processed?
You run packetbeat in debug mode?
Which outputs have you configured?
What kind of traffic are you pushing? Any timeouts in packetbeat due to missing requests/responses?
---
### Author:  [@ada\_pozo](https://discuss.elastic.co/u/ada_pozo)
#### Post date: [April 11, 2016, 2:06pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/5 "2016-04-11T14:06:35Z")
I can tell only 50 transactions per second appear in Kibana. I'm not running it in debug mode and it outputs only to elasticsearch. I'm using a http pcap file and there are some timeouts but not enough to justify so few packets.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [April 11, 2016, 3:53pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/6 "2016-04-11T15:53:55Z")
So you have like 50 transactions per second in elasticsearch, not packetbeat only processing 50 packets per second. Maybe it's a problem with indexing performance in elasticsearch. Have you tried to increase `bulk_max_size: ...` in elasticsearch output? Default size for ES is 50. If ES can not index fast enough, packetbeat will drop transaction events.
[Here are some tips for getting stats about filebeat output](https://discuss.elastic.co/t/filebeat-sending-data-to-logstash-seems-too-slow/37596/13). The same script and `httpprof` option works for packetbeat as well.
---
### Author:  [@ada\_pozo](https://discuss.elastic.co/u/ada_pozo)
#### Post date: [April 11, 2016, 4:57pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/7 "2016-04-11T16:57:07Z")
I have tried increasing bulk\_max\_size to 500 but the results are pretty much the same, 60 transactions per second in elasticsearch. I have also tried running packetbeat in debug mode and only about 1/10 of the packet I replay get processed and I also get a lot of warnings about gaps in the tcp stream. MAybe that has something to do with it?
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/packetbeat-performance/46834/8 "2017-07-05T21:53:29Z")