Read from pcap file VS Not read from pcap file

Elastic Stack Beats
1

First,I use follow command read data to es:
./packetbeat -e -c packetbeat-redis.yml

Second,I use follow command generate a trace.pcap file,and read from trace.pcap to es.
./packetbeat -c packetbeat-redis.yml -dump trace.pcap -d "publish"

But,first loss some data,second is not loss.By reason first is should the same as second.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.