We have been seeing a few issues with memory consumption in Metricbeat when the logstash-xpack module attempts to monitor very large Logstash pipelines (say, ones with a couple hundred vertices or more).

Each event generated by the logstash_state metricset corresponds to a single Logstash pipeline. The logstash_state.pipeline.representation.graph.vertices field is an array of vertex objects. Each vertex object looks like this:

            {
              "type": "plugin",
              "config_name": "tcp",
              "explicit_id": true,
              "id": "some_id",
              "meta": {
                "source": {
                  "column": 3,
                  "id": "/path/to/pipeline/file.conf",
                  "line": 20,
                  "protocol": "file"
                }
              },
              "plugin_type": "input"
            },

For a quick win in reducing memory consumption, we should audit which of these fields are actually being used by the Stack Monitoring UI and only keep those.