I'm not sure I'm following.
I answered Elasticsearch CPU utilization metrics are normalized by default but assumed you were talking about cpu percentage differences between what you see in Stack Monitoring and what you see in the Infra UI (or, what you see in .monitoring-es-*
documents versus what you see in metricbeat-*
documents).
Did I assume correctly? Or are you talking about monitoring Filebeat within the Stack Monitoring UI?