[packetbeats]

Depending on the traffic, the CPU usage of the agent could indeed be significant. We're thinking to implement sampling to reduce the effect of this. On the other hand, the agent is not "in-line" so it cannot introduce any latency, only steal CPU time from them.

So, unless you have a single CPU core, it's pretty safe to run in production. It cannot affect the application performance by much.

Thanks for noticing the broken link, we fixed it.

[zentrus]

What happens if more traffic is coming in than Packetbeat can process? Either you are dropping that traffic or you are (perhaps unintentionally) blocking it, right?

[packetbeats]

It will drop traffic in that case.

[pyvpx]

you might look into sFlow and/or IPFIX.