First,I use follow command read data to es:
./packetbeat -e -c packetbeat-redis.yml
Second,I use follow command generate a trace.pcap file,and read from trace.pcap to es.
./packetbeat -c packetbeat-redis.yml -dump trace.pcap -d "publish"
But,first loss some data,second is not loss.By reason first is should the same as second.