I'm new to packetbeat, and dived straight into exploring packetbeat events in Kibana setup to listen to a small preproduction environment. And I noticed a reoccuring spike every 10 seconds of 300 events being generated (the other 9 seconds have <20 events each second). The events start with http connections to my ES (initiated by packetbeat itself) and then a lot of flow events.
I don't understand flow events very well, other than they're bidirectional comm channels. Are these flow events being generated by packetbeat after an HTTP connection is established? If so, it seems like good practice to exclude these 300 events every 10 seconds from being reported as they drown out the other network traffic analysis I'd like to do.
Anyone else see this traffic heuristic from packetbeat?