Thank you for your response @andrewkroh
Topbeat is installed on 7 hosts and send data every 1 min. If I try your query (proc.cpu.user_p:>0 OR proc.mem.rss_p:>0) I get only 7 hits with "Last 24 hours" timestamp and 35 hits with "Last 7 days" timestamp, it's really poor compared to expected result.
One more thing to give you all information. Topbeat is configured to send data to a Logstash server (input beats) where I just add some fields (filter) brefore forward it to Elasticsearch (output elastic). So I don't think that's linked with my issue.
Do you have any other ideas for this issue?
About the 2nd issue I didn't see that in my data but I just was surprised when I saw this value because it's not logical. Anyway I will let you know if I see something like that in prod.