I don't know.
Are you collecting from the correct interfaces?
Is packbeat running on more than 1 host?
Are you stopping them all? before starting.. those errors mean the mapping is wrong again.
Have you just used discover and looks at some of the documents?
What happens when you go look at the hosts or network under Security Analytics?
you can start packetbeat manually like this.
packetbeat -e -d "*"
you will see what is published from packetbeat.
Here is another thread I wrote on this ... I follow my instructions and I get a map.
I did notice the network map under Security analytics is looking for a very specific field