Why packetbeat generates result of "libbeat.publisher.published_events" changing every time

Elastic Stack Beats
6

test with different queue_size value

the value of queue_size in packetbeat.yml is 1000 by default.

#================================ General =====================================
...
# Internal queue size for single events in processing pipeline
queue_size: 1000
  • case 1: queue_size=1000 and -waitstop=10
./packetbeat -c ./packetbeat.yml -e -I redis_xxx.pcap -E packetbeat.protocols.redis.ports=7101 -t -waitstop=10

the results are

... // first try
2017/01/18 06:13:21.498505 logp.go:271: INFO Total non-zero values:  tcp.dropped_because_of_gaps=4 libbeat.publisher.published_events=14184 redis.unmatched_responses=23
2017/01/18 06:13:21.498533 logp.go:272: INFO Uptime: 12.243276728s
... // second try
2017/01/18 06:14:48.174210 logp.go:271: INFO Total non-zero values:  libbeat.publisher.published_events=12337 tcp.dropped_because_of_gaps=4 redis.unmatched_responses=23
2017/01/18 06:14:48.174302 logp.go:272: INFO Uptime: 11.881996238s
... // third try
2017/01/18 06:15:13.140022 logp.go:271: INFO Total non-zero values:  redis.unmatched_responses=23 libbeat.publisher.published_events=11211 tcp.dropped_because_of_gaps=4
2017/01/18 06:15:13.140074 logp.go:272: INFO Uptime: 11.813326164s

as you can see, the value of "published_events" is changing every time.

  • case 2: queue_size=10000 and -waitstop=10
./packetbeat -c ./packetbeat.yml -e -I redis_xxx.pcap -E packetbeat.protocols.redis.ports=7101 -t -waitstop=10

the results are

... // first try
2017/01/18 06:17:06.842958 logp.go:271: INFO Total non-zero values:  libbeat.publisher.published_events=20678 tcp.dropped_because_of_gaps=4 redis.unmatched_responses=23
2017/01/18 06:17:06.843001 logp.go:272: INFO Uptime: 12.031343837s
... // second try
2017/01/18 06:17:25.012243 logp.go:271: INFO Total non-zero values:  libbeat.publisher.published_events=20678 tcp.dropped_because_of_gaps=4 redis.unmatched_responses=23
2017/01/18 06:17:25.012284 logp.go:272: INFO Uptime: 12.116870701s
... // third try
2017/01/18 06:17:40.081266 logp.go:271: INFO Total non-zero values:  redis.unmatched_responses=23 libbeat.publisher.published_events=20678 tcp.dropped_because_of_gaps=4
2017/01/18 06:17:40.081294 logp.go:272: INFO Uptime: 12.001298232s

oh my god, the value of "published_events" is 20678 every time, the results seem "stable"!

after dozens of tests, the result seems to be "almost" same. because i actually saw this

... // Nth try
2017/01/18 06:22:48.935181 logp.go:271: INFO Total non-zero values:  libbeat.publisher.published_events=20620 tcp.dropped_because_of_gaps=4 redis.unmatched_responses=23

but, anyway, i think I've got the answer.