I've changed template name to 'packets_template' and it started working. What ***? Filebeat has hardcoded only one template name?
Now in filebeat config:
setup.template.name: "packets_template"
setup.template.pattern: "packets_template*"
There is as well directive:
setup.template.overwrite: true
I see that it can really create template if not exists or recreate it (damage template I created?). I do not get what is the sense of this command; templates are created on Elasticsearch side, I do not think filebeat gives us possibility to create templates.
OK, now time to play with mappings...