You can do step by step debugging to find the actual issue
1)Are you seeing response times as zero for all transactions in elastic search ? I assume you are observing the response times for http transactions.
2)Only if for each request there is a related response,packetbeat will capture that as a transaction and calculate the response time.
So,as you are able to see the transactions in elasticsearch or logs we can rule out any issue with packetbeat not able to capture transactions.The response time being zero is a another point.
3)As per the logs that you shared ,looks like packetbeat is not able to correlate a response that it captured with any observed request.See here
You might want to check as some connections are dropped.
4)Other points that you could check are if you having any vlan tagging.
What is best for sniffing 25 app servers is something that I have not done but which you might want to first measure and then see if there are any performance problems and then decide.