Hi tbhaxor,
The packetbeat installation might be fresh, but what about the cluster? Did you perform an update? see a similar thread: Fielddata is disabled on text fields by default. Set fielddata=true on [host.name] in order to load fielddata in memory by uninverting the inverted index