Ahh, good tip, that will prevent some number of problems in the future. I'll have to reindex all my current data though.
As for osquery being in metricbeat, that's actually where I looked for it originally. I'd say 75% of the things I'm planning on tracking with osquery actually match the metric style thought pattern vs the log style pattern.