Thanks for this report.
It looks like the feature (Mac address logging) is incomplete indeed
In your pcap, it looks like this code is reached at 2 places : when doing the upgrade from HTTP1 to HTTP2, and at timeout
jq 'select(.ether == null)' log/eve.json