Packetbeat performance

So you have like 50 transactions per second in elasticsearch, not packetbeat only processing 50 packets per second. Maybe it's a problem with indexing performance in elasticsearch. Have you tried to increase bulk_max_size: ... in elasticsearch output? Default size for ES is 50. If ES can not index fast enough, packetbeat will drop transaction events.

Here are some tips for getting stats about filebeat output. The same script and httpprof option works for packetbeat as well.