Beats: packetbeat: packetbeat should quit only after all events have been published when reading from pcap file

[moooofly]

When I used packetbeat to analyse pcap files for redis protocol, I found that the output value of "libbeat.publisher.published_events" changing every time. After some discussion with steffens (https://discuss.elastic.co/t/why-packetbeat-generates-result-of-libbeat-publisher-published-events-changing-every-time/71699), the conclusion comes to "The pcap reading mode is mostly used for debugging/testing purposes, that's why there is no special 'blocking' support in the queue.". But what I need is exactly that making sure packetbeat quit only after all events have been published.

Would like to see this feature added. Thanks!

Some information :

• Version: packetbeat; Version: 6.0.0-alpha1
• Operating System: 3.19.0-15-generic 15-Ubuntu SMP x86_64 GNU/Linux
• Steps to Reproduce: see this link.

[urso]

Agreed, if we read from pcap, there is no need to drop events.

Plus I'd like to get rid of -waitstop and replace it with shutdown_timeout as we have it in filebeat (e.g. stop if all events have been published, but wait up to N seconds to publish queue - value of 0 means wait till stopped). This should help speeding up the tests somewhat + it's easier to write new protocol tests from the beginning.

[McStork]

I need this feature so much too!

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic[bot]]

This issue doesn't have a Team:<team> label.