The metrics value monitoring.metrics.beat.libbeat.output.events.active can be skewed to inaccurate totals. I observed this in main after heavy ingestion that concluded (with all events ingested and no genuine active events) with an events.active of 959. filebeat.events.active showed the correct total of 0. (Of the two, Filebeat is usually the lagging metric, since it receives acknowledgment notifications later than the output.)

The run where this issue was observed involved both batch splitting and 529 errors from upstream, so either or both of those could be factors.