I'm testing fleet and I have noticed that filebeat and metricbeat use quite a few CPU cycles. I'm using the Windows, System and IIS integrations, and on an 8 vcpu VM, filebeat consistently consumes 20%. Metricbeat consumes anywhere from 5% - 15% on the same machine. Is this normal? These CPUs are a bit older (Intel xeon v2) but I feel that the usage is more than it should be. Is there any way to maybe customize how often filebeat collects logs? I left all the defaults in place for everything for those integrations (some items in metricbeat are at 10s, some at 1m).
On Linux, I'm also seeing higher CPU usage than I would hope for from filebeat deployed via the agent.