In versions of Winlogbeat prior to 7.10.2, the go runtime defaults to
MADV_FREE by default.
In some cases, this can lead to high RSS memory usage while the kernel waits to reclaim any pages assigned to Winlogbeat.
On versions prior to 7.10.2, set the
GODEBUG="madvdontneed=1" environment variable if you run into RSS usage issues.
Intro to Kibana
ELK for Logs & Metrics