# Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing? **URL:** \ **Category:** Beats\ **Created:** [April 6, 2017, 8:10pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530 "2017-04-06T20:10:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Niveah\_Tefillah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niveah_tefillah/32/17079_2.png) [@Niveah\_Tefillah](https://discuss.elastic.co/u/Niveah_Tefillah)\ **Post date:** [April 6, 2017, 8:10pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530/1 "2017-04-06T20:10:47Z")
Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 6, 2017, 10:42pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530/2 "2017-04-06T22:42:17Z")
Are you using `-waitstop ` to give Packetbeat time to finish sending the events before exiting? ```auto -waitstop int Additional seconds to wait before shutting down ``` ---
**Author:** ![Niveah\_Tefillah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niveah_tefillah/32/17079_2.png) [@Niveah\_Tefillah](https://discuss.elastic.co/u/Niveah_Tefillah)\ **Post date:** [April 7, 2017, 12:12am UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530/3 "2017-04-07T00:12:50Z")
Yes, even when I try it with waitstop I still obtain varying number of hits on kibana for the same pcap file with 2k odd packets. However, I did read in a different post which said "While you can use Packetbeat to read the packets from a pcap file, its implementation assumes that the packets are read in real time, which can cause some issues with timeout transactions (the time is measured from the current time, not from the initial packet's time". And I want to believe this is the reason for my issue but I cannot tell for real. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 7, 2017, 4:48pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530/4 "2017-04-07T16:48:39Z")
This discussion pretty much explains whats going on: [Why packetbeat generates result of "libbeat.publisher.published\_events" changing every time](https://discuss.elastic.co/t/why-packetbeat-generates-result-of-libbeat-publisher-published-events-changing-every-time/71699) The last 2 posts do contain some follow-up github tickets improving on the pcap-reading use-case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 27, 2017, 8:10pm UTC](https://discuss.elastic.co/t/why-everytime-i-run-packetbeat-and-i-open-kibana-to-see-the-indexed-pcap-data-the-number-of-hits-of-the-same-pcap-file-keep-changing/81530/5 "2017-04-27T20:10:55Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.