Why everytime I run packetbeat and I open kibana to see the indexed pcap data the number of hits of the same pcap file keep changing?

[steffens (Steffen Siering)]

This discussion pretty much explains whats going on: Why packetbeat generates result of "libbeat.publisher.published_events" changing every time

The last 2 posts do contain some follow-up github tickets improving on the pcap-reading use-case.