Packetbeat use mem too many when monitor cassandra

do you have some packetbeat logs, and/or pcap file for testing? No idea wether this is a potential leak or incomplete transactions hanging in memory due to packet loss (have you tried af_packet sniffer?).