The one screenshot you posted contained an warning that occurred while indexing an event to Elasticsearch. It says that it cannot index the event (status=400)... No handler for type [keyword] declared on field real_ip.
What version of Elasticsearch are you using? By default, Packetbeat 5.x expects you to be using Elasticsearch 5.x and it installs an index template that is only compatible with ES 5.x. You need to stop Packetbeat, delete the index template, delete the index, install the correct index template, and then restart Packetbeat.
- Stop Packetbeat.
- Change the config file to point to the template for ES 2.x. Set the path to point to
packetbeat.template-es2x.json which is included with the download.
- Delete the index template.
- Delete the packetbeat indexes you created.
- Start up Packetbeat which will install the ES 2.x index template
Are you sure you don't have flows enabled -- https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-flows.html
This would cause Packetbeat to capture everything.