Read from pcap file VS Not read from pcap file

First,I use follow command read data to es:
./packetbeat -e -c packetbeat-redis.yml

Second,I use follow command generate a trace.pcap file,and read from trace.pcap to es.
./packetbeat -c packetbeat-redis.yml -dump trace.pcap -d "publish"

But,first loss some data,second is not loss.By reason first is should the same as second.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.