Packetbeat missing some data
You have to increase a transaction_timeout setting as it is set to 10s by default. Your second query runs 10 secs and considers as expired, but expired transactions are no longer correlated to incoming responses and sent to Elasticsearch immediately.