I used packetbeat on multiple hosts. So I needed to disable the outgoing messages. The problem was that despite having a proper configuration of /etc/hostname and /etc/hosts, in the publisher class it was not resolved resulting in messages being published anyway. So I made a small change: I did use a map of local IPs and droped the messages with Src.IP == any local IP. Are you interested in that small modification?