Topbeat - Detailed flowchart or documentation on how it works

I understand your request for such a mathematical model (see also Beats Overhead Topbeat and Packetbeat). One of the challenges in publishing such a model is that is has lots of small variables which must be taken into account which leads to that most of the calculations are wrong. We could publish an example with data on a machine which uses the default config but that would not apply to most of the production servers and would be misleading. Also not only does it depend on the beat but also on the setup of elasticsearch (number of replicas, shards).

When do you your POC, make sure to have it as close to the production system especially for packetbeat, as the type and content of the packages can make a big difference.