Filebeat.exe allocates too much memory on Windows server 2016

[petertw6235]

Dear Sir:

We use filebeat to parse our log and send the data to kafka -> logstash -> elasticsearch.
But we found the memory consumed by filebeat.exe was over 1.6Gb.

We also check the filebeat log.
{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":20094093,"time":{"ms":47}},"total":{"ticks":69999280,"time":{"ms":141},"value":69999280},"user":{"ticks":49905187,"time":{"ms":94}}},"handles":{"open":350},"info":{"ephemeral_id":"569cfdc9-b0fa-4fbc-8fe6-81beeca36c14","uptime":{"ms":25044600183}},"memstats":{"gc_next":44772592,"memory_alloc":22529120,"memory_total":239248376304}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}

The memory_alloc is about 21MB. But we got 1.7gb in our windows task manager.
"memstats":{"gc_next":44772592,"memory_alloc":22529120,"memory_total":239248376304}}

1. What is the correct monitoring data about the memory states? Windows task manager or filebeat log. Why we got different results between task manager and filebeat?
2. The following is our env and filebeat.yml. Any suggestion about tuning the memory issue?

Filebeat version: 7.0.0
OS: Windows Server 2016

filebeat.yml

filebeat.inputs:

- type: log

  enabled: true

  paths:
    - D:\Log\MsmqMonitorLogs\*
  multiline.pattern: '^\['

  multiline.negate: true
  multiline.match: after

output.kafka:
  hosts: ["xxx.xxx.xxx.xxx:9092"]
  topic: "test-topic"
  codec.json:
    pretty: false

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

[warkolm (Mark Walkom)]

That's virtual memory, which is managed by the operating system.