Hi,
It appears that Packetbeat 5.5.0 (the HTTP module) only gets the last word from HTTP status line when searching for the response phrase.
HTTP/1.1 500 Internal Server Error turns into "Error" in the http.response.phrase field and HTTP/1.1 404 Not Found gets parsed as "Found".
Here are some examples of response headers and HTTP status lines (as reported by curl) that were not parsed correctly by Packetbeat:
HTTP/1.1 404 Not Found
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 949
Date: Mon, 31 Jul 2017 11:31:53 GMT
HTTP/1.1 500 Internal Server Error
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 3739
Date: Mon, 31 Jul 2017 11:33:28 GMT
Connection: close
Apart from the response phrase, I haven't noticed any other erroneous values being reported by Packetbeat.