Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing?

Elastic Stack Beats
1

Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing?

2

Are you using -waitstop <seconds> to give Packetbeat time to finish sending the events before exiting?

  -waitstop int
    	Additional seconds to wait before shutting down
1 Like
3

Yes, even when I try it with waitstop I still obtain varying number of hits on kibana for the same pcap file with 2k odd packets. However, I did read in a different post which said "While you can use Packetbeat to read the packets from a pcap file, its implementation assumes that the packets are read in real time, which can cause some issues with timeout transactions (the time is measured from the current time, not from the initial packet's time". And I want to believe this is the reason for my issue but I cannot tell for real.

4

This discussion pretty much explains whats going on: Why packetbeat generates result of "libbeat.publisher.published_events" changing every time

The last 2 posts do contain some follow-up github tickets improving on the pcap-reading use-case.

5

This topic was automatically closed after 21 days. New replies are no longer allowed.