It appears that Packetbeat 5.5.0 (the HTTP module) only gets the last word from HTTP status line when searching for the response phrase.
HTTP/1.1 500 Internal Server Error turns into "Error" in the
http.response.phrase field and
HTTP/1.1 404 Not Found gets parsed as "Found".
Here are some examples of response headers and HTTP status lines (as reported by curl) that were not parsed correctly by Packetbeat:
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 949 Date: Mon, 31 Jul 2017 11:31:53 GMT HTTP/1.1 500 Internal Server Error Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 3739 Date: Mon, 31 Jul 2017 11:33:28 GMT Connection: close
Apart from the response phrase, I haven't noticed any other erroneous values being reported by Packetbeat.