there are lots of fields that are labeled with actual! What is the difference?
mem.actual_used?
From what I know "actual" means the "used" memory minus the memory used for disk caches and buffers. We could do a better job here with the docs, true.
That is what I come to believe also thanks for the reinforcement.
Thanks for the feedback. I created already a PR to fix it: https://github.com/elastic/beats/pull/466