diff --git a/x-pack/plugins/monitoring/server/alerts/base_alert.ts b/x-pack/plugins/monitoring/server/alerts/base_alert.ts
index 016acf2737f9b..f583b4882f83c 100644
--- a/x-pack/plugins/monitoring/server/alerts/base_alert.ts
+++ b/x-pack/plugins/monitoring/server/alerts/base_alert.ts
@@ -9,6 +9,7 @@ import {
   ILegacyCustomClusterClient,
   Logger,
   IUiSettingsClient,
+  LegacyCallAPIOptions,
 } from 'kibana/server';
 import { i18n } from '@kbn/i18n';
 import {
@@ -36,6 +37,8 @@ import { MonitoringConfig } from '../config';
 import { AlertSeverity } from '../../common/enums';
 import { CommonAlertFilter, CommonAlertParams, CommonBaseAlert } from '../../common/types';
 import { MonitoringLicenseService } from '../types';
+import { mbSafeQuery } from '../lib/mb_safe_query';
+import { appendMetricbeatIndex } from '../lib/alerts/append_mb_index';
 
 export class BaseAlert {
   public type!: string;
@@ -212,13 +215,20 @@ export class BaseAlert {
       `Executing alert with params: ${JSON.stringify(params)} and state: ${JSON.stringify(state)}`
     );
 
-    const callCluster = this.monitoringCluster
+    const _callCluster = this.monitoringCluster
       ? this.monitoringCluster.callAsInternalUser
       : services.callCluster;
+    const callCluster = async (
+      endpoint: string,
+      clientParams?: Record<string, unknown>,
+      options?: LegacyCallAPIOptions
+    ) => {
+      return await mbSafeQuery(async () => _callCluster(endpoint, clientParams, options));
+    };
     const availableCcs = this.config.ui.ccs.enabled ? await fetchAvailableCcs(callCluster) : [];
     // Support CCS use cases by querying to find available remote clusters
     // and then adding those to the index pattern we are searching against
-    let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
+    let esIndexPattern = appendMetricbeatIndex(this.config, INDEX_PATTERN_ELASTICSEARCH);
     if (availableCcs) {
       esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
     }
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
index 4b083787f58cb..66085b53516a2 100644
--- a/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_health_alert.test.ts
@@ -66,7 +66,11 @@ describe('ClusterHealthAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
index c330e977e53d8..2705a77e0fce4 100644
--- a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.test.ts
@@ -70,7 +70,11 @@ describe('CpuUsageAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
index afe5abcf1ebd7..5bca84e33da3c 100644
--- a/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
+++ b/x-pack/plugins/monitoring/server/alerts/cpu_usage_alert.ts
@@ -31,6 +31,7 @@ import {
   CommonAlertParams,
   CommonAlertParamDetail,
 } from '../../common/types';
+import { appendMetricbeatIndex } from '../lib/alerts/append_mb_index';
 
 const RESOLVED = i18n.translate('xpack.monitoring.alerts.cpuUsage.resolved', {
   defaultMessage: 'resolved',
@@ -137,7 +138,7 @@ export class CpuUsageAlert extends BaseAlert {
     uiSettings: IUiSettingsClient,
     availableCcs: string[]
   ): Promise<AlertData[]> {
-    let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
+    let esIndexPattern = appendMetricbeatIndex(this.config, INDEX_PATTERN_ELASTICSEARCH);
     if (availableCcs) {
       esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
     }
diff --git a/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
index ed300c211215b..1db85f915d794 100644
--- a/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/elasticsearch_version_mismatch_alert.test.ts
@@ -69,7 +69,11 @@ describe('ElasticsearchVersionMismatchAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
index dd3b37b5755e7..362532a995f2d 100644
--- a/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/kibana_version_mismatch_alert.test.ts
@@ -72,7 +72,11 @@ describe('KibanaVersionMismatchAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
index e2f21b34efe21..da94e4af83802 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration_alert.test.ts
@@ -76,7 +76,11 @@ describe('LicenseExpirationAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
index fbb4a01d5b4ed..5ed189014cc6e 100644
--- a/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/logstash_version_mismatch_alert.test.ts
@@ -69,7 +69,11 @@ describe('LogstashVersionMismatchAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
index 4b3e3d2d6cb6d..ec2b19eb5dfae 100644
--- a/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/nodes_changed_alert.test.ts
@@ -82,7 +82,11 @@ describe('NodesChangedAlert', () => {
     });
     const monitoringCluster = null;
     const config = {
-      ui: { ccs: { enabled: true }, container: { elasticsearch: { enabled: false } } },
+      ui: {
+        ccs: { enabled: true },
+        container: { elasticsearch: { enabled: false } },
+        metricbeat: { index: 'metricbeat-*' },
+      },
     };
     const kibanaUrl = 'http://localhost:5601';
 
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/append_mb_index.ts b/x-pack/plugins/monitoring/server/lib/alerts/append_mb_index.ts
new file mode 100644
index 0000000000000..683a0dfeccb1f
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/append_mb_index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { MonitoringConfig } from '../../config';
+
+export function appendMetricbeatIndex(config: MonitoringConfig, indexPattern: string) {
+  return `${indexPattern},${config.ui.metricbeat.index}`;
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/get_ccs_index_pattern.ts b/x-pack/plugins/monitoring/server/lib/alerts/get_ccs_index_pattern.ts
index 7fdbc79685f7c..1907d2b4b3401 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/get_ccs_index_pattern.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/get_ccs_index_pattern.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 export function getCcsIndexPattern(indexPattern: string, remotes: string[]): string {
-  return `${indexPattern},${indexPattern
-    .split(',')
-    .map((pattern) => {
-      return remotes.map((remoteName) => `${remoteName}:${pattern}`).join(',');
-    })
-    .join(',')}`;
+  const patternsToAdd = [];
+  for (const index of indexPattern.split(',')) {
+    for (const remote of remotes) {
+      patternsToAdd.push(`${remote}:${index}`);
+    }
+  }
+  return [...indexPattern.split(','), ...patternsToAdd].join(',');
 }
diff --git a/x-pack/plugins/monitoring/server/lib/apm/_get_time_of_last_event.js b/x-pack/plugins/monitoring/server/lib/apm/_get_time_of_last_event.js
index f08f92bffe790..37e739d0066a0 100644
--- a/x-pack/plugins/monitoring/server/lib/apm/_get_time_of_last_event.js
+++ b/x-pack/plugins/monitoring/server/lib/apm/_get_time_of_last_event.js
@@ -26,6 +26,7 @@ export async function getTimeOfLastEvent({
         {
           timestamp: {
             order: 'desc',
+            unmapped_type: 'long',
           },
         },
       ],
diff --git a/x-pack/plugins/monitoring/server/lib/apm/get_apm_info.js b/x-pack/plugins/monitoring/server/lib/apm/get_apm_info.js
index cc3682ef764c8..0b2e833933177 100644
--- a/x-pack/plugins/monitoring/server/lib/apm/get_apm_info.js
+++ b/x-pack/plugins/monitoring/server/lib/apm/get_apm_info.js
@@ -73,7 +73,7 @@ export async function getApmInfo(req, apmIndexPattern, { clusterUuid, apmUuid, s
       'hits.hits.inner_hits.first_hit.hits.hits._source.beats_stats.metrics.libbeat.output.write.bytes',
     ],
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({
         start,
         end,
diff --git a/x-pack/plugins/monitoring/server/lib/apm/get_apms.js b/x-pack/plugins/monitoring/server/lib/apm/get_apms.js
index 19ed8298391d7..03a395e87d860 100644
--- a/x-pack/plugins/monitoring/server/lib/apm/get_apms.js
+++ b/x-pack/plugins/monitoring/server/lib/apm/get_apms.js
@@ -128,8 +128,8 @@ export async function getApms(req, apmIndexPattern, clusterUuid) {
         },
       },
       sort: [
-        { 'beats_stats.beat.uuid': { order: 'asc' } }, // need to keep duplicate uuids grouped
-        { timestamp: { order: 'desc' } }, // need oldest timestamp to come first for rate calcs to work
+        { 'beats_stats.beat.uuid': { order: 'asc', unmapped_type: 'long' } }, // need to keep duplicate uuids grouped
+        { timestamp: { order: 'desc', unmapped_type: 'long' } }, // need oldest timestamp to come first for rate calcs to work
       ],
     },
   };
diff --git a/x-pack/plugins/monitoring/server/lib/beats/get_beat_summary.js b/x-pack/plugins/monitoring/server/lib/beats/get_beat_summary.js
index 30ec728546ce9..962018f88354d 100644
--- a/x-pack/plugins/monitoring/server/lib/beats/get_beat_summary.js
+++ b/x-pack/plugins/monitoring/server/lib/beats/get_beat_summary.js
@@ -78,7 +78,7 @@ export async function getBeatSummary(
       'hits.hits.inner_hits.first_hit.hits.hits._source.beats_stats.metrics.libbeat.output.write.bytes',
     ],
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createBeatsQuery({
         start,
         end,
diff --git a/x-pack/plugins/monitoring/server/lib/beats/get_beats.js b/x-pack/plugins/monitoring/server/lib/beats/get_beats.js
index a5d43d1da7ebc..af4b6c31a3e5e 100644
--- a/x-pack/plugins/monitoring/server/lib/beats/get_beats.js
+++ b/x-pack/plugins/monitoring/server/lib/beats/get_beats.js
@@ -126,8 +126,8 @@ export async function getBeats(req, beatsIndexPattern, clusterUuid) {
         },
       },
       sort: [
-        { 'beats_stats.beat.uuid': { order: 'asc' } }, // need to keep duplicate uuids grouped
-        { timestamp: { order: 'desc' } }, // need oldest timestamp to come first for rate calcs to work
+        { 'beats_stats.beat.uuid': { order: 'asc', unmapped_type: 'long' } }, // need to keep duplicate uuids grouped
+        { timestamp: { order: 'desc', unmapped_type: 'long' } }, // need oldest timestamp to come first for rate calcs to work
       ],
     },
   };
diff --git a/x-pack/plugins/monitoring/server/lib/ccs_utils.js b/x-pack/plugins/monitoring/server/lib/ccs_utils.js
index bef07124fb430..96910dd86a94d 100644
--- a/x-pack/plugins/monitoring/server/lib/ccs_utils.js
+++ b/x-pack/plugins/monitoring/server/lib/ccs_utils.js
@@ -13,7 +13,7 @@ export function appendMetricbeatIndex(config, indexPattern) {
   if (isFunction(config.get)) {
     mbIndex = config.get('monitoring.ui.metricbeat.index');
   } else {
-    mbIndex = get(config, 'monitoring.ui.metricbeat.index');
+    mbIndex = get(config, 'ui.metricbeat.index');
   }
 
   const newIndexPattern = `${indexPattern},${mbIndex}`;
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/flag_supported_clusters.js b/x-pack/plugins/monitoring/server/lib/cluster/flag_supported_clusters.js
index 8e0d125d122aa..a1674b2f5eb36 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/flag_supported_clusters.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/flag_supported_clusters.js
@@ -31,7 +31,7 @@ async function findSupportedBasicLicenseCluster(
     ignoreUnavailable: true,
     filterPath: 'hits.hits._source.cluster_uuid',
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: {
         bool: {
           filter: [
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_cluster_license.js b/x-pack/plugins/monitoring/server/lib/cluster/get_cluster_license.js
index a167837969bd0..bd84fbb66f962 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_cluster_license.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_cluster_license.js
@@ -18,7 +18,7 @@ export function getClusterLicense(req, esIndexPattern, clusterUuid) {
     ignoreUnavailable: true,
     filterPath: 'hits.hits._source.license',
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({
         type: 'cluster_stats',
         clusterUuid,
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_state.js b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_state.js
index 33e4ec96676b2..fa5526728086e 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_state.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_state.js
@@ -70,7 +70,7 @@ export function getClustersState(req, esIndexPattern, clusters) {
       collapse: {
         field: 'cluster_uuid',
       },
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_stats.js b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_stats.js
index 945bf1f2e19a2..8ddd33837f56e 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_stats.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_stats.js
@@ -67,7 +67,7 @@ function fetchClusterStats(req, esIndexPattern, clusterUuid) {
       collapse: {
         field: 'cluster_uuid',
       },
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/ccr.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/ccr.js
index 209a48cce369c..0f0ba49f229b0 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/ccr.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/ccr.js
@@ -37,7 +37,7 @@ export async function checkCcrEnabled(req, esIndexPattern) {
         clusterUuid,
         metric: metricFields,
       }),
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
     filterPath: ['hits.hits._source.stack_stats.xpack.ccr'],
   };
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.js
index db8c89c364463..00e750b17d57b 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_last_recovery.js
@@ -61,7 +61,7 @@ export function getLastRecovery(req, esIndexPattern) {
     ignoreUnavailable: true,
     body: {
       _source: ['index_recovery.shards'],
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({ type: 'index_recovery', start, end, clusterUuid, metric }),
     },
   };
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_ml_jobs.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_ml_jobs.js
index 74d4bd6d2b5df..71f3633406c9b 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/get_ml_jobs.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/get_ml_jobs.js
@@ -42,7 +42,7 @@ export function getMlJobs(req, esIndexPattern) {
       'hits.hits._source.job_stats.node.name',
     ],
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       collapse: { field: 'job_stats.job_id' },
       query: createQuery({ type: 'job_stats', start, end, clusterUuid, metric }),
     },
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_index_summary.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_index_summary.js
index 524eaca191eec..6a0935f2b2d67 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_index_summary.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_index_summary.js
@@ -69,7 +69,7 @@ export function getIndexSummary(
     size: 1,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({ type: 'index_stats', start, end, clusterUuid, metric, filters }),
     },
   };
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_indices.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_indices.js
index ba6d0cb926f06..cc3dec9f085b7 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_indices.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/indices/get_indices.js
@@ -129,7 +129,7 @@ export function buildGetIndicesQuery(
           sort: [{ timestamp: 'asc' }],
         },
       },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
   };
 }
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_node_summary.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_node_summary.js
index 84384021a3593..06f5d5488a1ae 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_node_summary.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_node_summary.js
@@ -109,7 +109,7 @@ export function getNodeSummary(
     size: 1,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({ type: 'node_stats', start, end, clusterUuid, metric, filters }),
     },
   };
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_nodes.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_nodes.js
index c2794b7e7fa44..3766845d39b4f 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_nodes.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_nodes.js
@@ -92,7 +92,7 @@ export async function getNodes(req, esIndexPattern, pageOfNodes, clusterStats, n
           },
         },
       },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
     filterPath: [
       'hits.hits._source.source_node',
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_indices_unassigned_shard_stats.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_indices_unassigned_shard_stats.js
index e8728e9c53ec5..f39233b29a1ce 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_indices_unassigned_shard_stats.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_indices_unassigned_shard_stats.js
@@ -20,7 +20,7 @@ async function getUnassignedShardData(req, esIndexPattern, cluster) {
     size: 0,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({
         type: 'shards',
         clusterUuid: cluster.cluster_uuid,
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_nodes_shard_count.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_nodes_shard_count.js
index 7823884dc749d..41a4740675637 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_nodes_shard_count.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_nodes_shard_count.js
@@ -19,7 +19,7 @@ async function getShardCountPerNode(req, esIndexPattern, cluster) {
     size: 0,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({
         type: 'shards',
         clusterUuid: cluster.cluster_uuid,
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_shard_stats.js b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_shard_stats.js
index 1154655ab6a22..2ac1e99add4de 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_shard_stats.js
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/shards/get_shard_stats.js
@@ -57,7 +57,7 @@ export function getShardStats(
     size: 0,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query: createQuery({
         type: 'shards',
         clusterUuid: cluster.cluster_uuid,
diff --git a/x-pack/plugins/monitoring/server/lib/kibana/get_kibana_info.js b/x-pack/plugins/monitoring/server/lib/kibana/get_kibana_info.js
index 533354f1e27b3..5a3e2dea930e0 100644
--- a/x-pack/plugins/monitoring/server/lib/kibana/get_kibana_info.js
+++ b/x-pack/plugins/monitoring/server/lib/kibana/get_kibana_info.js
@@ -41,7 +41,7 @@ export function getKibanaInfo(req, kbnIndexPattern, { clusterUuid, kibanaUuid })
         },
       },
       collapse: { field: 'kibana_stats.kibana.uuid' },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/lib/kibana/get_kibanas.js b/x-pack/plugins/monitoring/server/lib/kibana/get_kibanas.js
index f0e3f961a498f..b65f7770119fc 100644
--- a/x-pack/plugins/monitoring/server/lib/kibana/get_kibanas.js
+++ b/x-pack/plugins/monitoring/server/lib/kibana/get_kibanas.js
@@ -44,7 +44,7 @@ export function getKibanas(req, kbnIndexPattern, { clusterUuid }) {
       collapse: {
         field: 'kibana_stats.kibana.uuid',
       },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
       _source: [
         'timestamp',
         'kibana_stats.process.memory.resident_set_size_in_bytes',
diff --git a/x-pack/plugins/monitoring/server/lib/logs/get_log_types.js b/x-pack/plugins/monitoring/server/lib/logs/get_log_types.js
index fd7b5d457409f..7947a5b6797ae 100644
--- a/x-pack/plugins/monitoring/server/lib/logs/get_log_types.js
+++ b/x-pack/plugins/monitoring/server/lib/logs/get_log_types.js
@@ -65,7 +65,7 @@ export async function getLogTypes(
     filterPath: ['aggregations.levels.buckets', 'aggregations.types.buckets'],
     ignoreUnavailable: true,
     body: {
-      sort: { '@timestamp': { order: 'desc' } },
+      sort: { '@timestamp': { order: 'desc', unmapped_type: 'long' } },
       query: {
         bool: {
           filter,
diff --git a/x-pack/plugins/monitoring/server/lib/logs/get_logs.js b/x-pack/plugins/monitoring/server/lib/logs/get_logs.js
index bb453e09454af..7952bc02b91c2 100644
--- a/x-pack/plugins/monitoring/server/lib/logs/get_logs.js
+++ b/x-pack/plugins/monitoring/server/lib/logs/get_logs.js
@@ -82,7 +82,7 @@ export async function getLogs(
     ],
     ignoreUnavailable: true,
     body: {
-      sort: { '@timestamp': { order: 'desc' } },
+      sort: { '@timestamp': { order: 'desc', unmapped_type: 'long' } },
       query: {
         bool: {
           filter,
diff --git a/x-pack/plugins/monitoring/server/lib/logstash/get_node_info.js b/x-pack/plugins/monitoring/server/lib/logstash/get_node_info.js
index 929dd53f74776..fdfc523e53527 100644
--- a/x-pack/plugins/monitoring/server/lib/logstash/get_node_info.js
+++ b/x-pack/plugins/monitoring/server/lib/logstash/get_node_info.js
@@ -46,7 +46,7 @@ export function getNodeInfo(req, lsIndexPattern, { clusterUuid, logstashUuid })
         },
       },
       collapse: { field: 'logstash_stats.logstash.uuid' },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/lib/logstash/get_nodes.js b/x-pack/plugins/monitoring/server/lib/logstash/get_nodes.js
index 57adaff9be1c4..9b8786f8ae017 100644
--- a/x-pack/plugins/monitoring/server/lib/logstash/get_nodes.js
+++ b/x-pack/plugins/monitoring/server/lib/logstash/get_nodes.js
@@ -44,7 +44,7 @@ export function getNodes(req, lsIndexPattern, { clusterUuid }) {
       collapse: {
         field: 'logstash_stats.logstash.uuid',
       },
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
       _source: [
         'timestamp',
         'logstash_stats.process.cpu.percent',
diff --git a/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_state_document.js b/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_state_document.js
index d844e3604ca79..dae8d52e6c57b 100644
--- a/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_state_document.js
+++ b/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_state_document.js
@@ -37,7 +37,7 @@ export async function getPipelineStateDocument(
     ignoreUnavailable: true,
     body: {
       _source: { excludes: 'logstash_state.pipeline.representation.plugins' },
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query,
       terminate_after: 1, // Safe to do because all these documents are functionally identical
     },
diff --git a/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_versions.js b/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_versions.js
index 91ac158b22494..c51f0f3ea1c03 100644
--- a/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_versions.js
+++ b/x-pack/plugins/monitoring/server/lib/logstash/get_pipeline_versions.js
@@ -83,7 +83,7 @@ function fetchPipelineVersions(...args) {
     size: 0,
     ignoreUnavailable: true,
     body: {
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
       query,
       aggs,
     },
diff --git a/x-pack/plugins/monitoring/server/lib/mb_safe_query.ts b/x-pack/plugins/monitoring/server/lib/mb_safe_query.ts
new file mode 100644
index 0000000000000..86bf5de8601e0
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/mb_safe_query.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * This function is designed to enable us to query against `.monitoring-*` and `metricbeat-*`
+ * indices SAFELY. We are adding the proper aliases into `metricbeat-*` to ensure all existing
+ * queries/aggs continue to work but we need to handle the reality that these aliases will not
+ * exist for older metricbeat-* indices, created before the aliases existed.
+ *
+ * Certain parts of a query will fail in this scenario, throwing an exception because of unmapped fields.
+ * So far, this is known to affect `sort` and `collapse` search query parameters. We have a way
+ * to handle this error elegantly with `sort` but not with `collapse` so we handle it manually in this spot.
+ *
+ * We can add future edge cases in here as well.
+ *
+ * @param queryExecutor
+ */
+export const mbSafeQuery = async (queryExecutor: () => Promise<any>) => {
+  try {
+    return await queryExecutor();
+  } catch (err) {
+    if (
+      err.message.includes('no mapping found for') &&
+      err.message.includes('in order to collapse on')
+    ) {
+      return {};
+    }
+    throw err;
+  }
+};
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index d874c868ae8e8..fb0bf4ac530b1 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -34,6 +34,7 @@ import { requireUIRoutes } from './routes';
 import { initBulkUploader } from './kibana_monitoring';
 // @ts-ignore
 import { initInfraSource } from './lib/logs/init_infra_source';
+import { mbSafeQuery } from './lib/mb_safe_query';
 import { instantiateClient } from './es_client/instantiate_client';
 import { registerCollectors } from './kibana_monitoring/collectors';
 import { registerMonitoringCollection } from './telemetry_collection';
@@ -351,7 +352,9 @@ export class Plugin {
                     callWithRequest: async (_req: any, endpoint: string, params: any) => {
                       const client =
                         name === 'monitoring' ? cluster : this.legacyShimDependencies.esDataClient;
-                      return client.asScoped(req).callAsCurrentUser(endpoint, params);
+                      return mbSafeQuery(() =>
+                        client.asScoped(req).callAsCurrentUser(endpoint, params)
+                      );
                     },
                   }),
                 },
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr.js b/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr.js
index 9999ba774b28d..fbaac56aa7400 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr.js
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr.js
@@ -99,7 +99,7 @@ function buildRequest(req, config, esIndexPattern) {
       'aggregations.by_follower_index.buckets.by_shard_id.buckets.follower_lag_ops.value',
     ],
     body: {
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
       query: {
         bool: {
           must: [
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr_shard.js b/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr_shard.js
index 4ee6cfe7fc54f..0a4b60b173254 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr_shard.js
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/elasticsearch/ccr_shard.js
@@ -37,7 +37,7 @@ async function getCcrStat(req, esIndexPattern, filters) {
       'hits.hits.inner_hits.oldest.hits.hits._source.ccr_stats.failed_read_requests',
     ],
     body: {
-      sort: [{ timestamp: { order: 'desc' } }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
       query: {
         bool: {
           must: [
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
index 0585ec2c08274..d153c40bbe58b 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
@@ -355,7 +355,7 @@ async function fetchBeatsByType(
       }),
       from: page * HITS_SIZE,
       collapse: { field: `${type}.beat.uuid` },
-      sort: [{ [`${type}.timestamp`]: 'desc' }],
+      sort: [{ [`${type}.timestamp`]: { order: 'desc', unmapped_type: 'long' } }],
       size: HITS_SIZE,
     },
   };
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
index 708bef31d8ac8..6325ed0c4b052 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
@@ -64,7 +64,7 @@ export function fetchElasticsearchStats(
         },
       },
       collapse: { field: 'cluster_uuid' },
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
index 0f6a86af79e45..481afc86fd115 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
@@ -329,7 +329,7 @@ export async function fetchHighLevelStats<
         // a more ideal field would be the concatenation of the uuid + transport address for duped UUIDs (copied installations)
         field: `${product}_stats.${product}.uuid`,
       },
-      sort: [{ timestamp: 'desc' }],
+      sort: [{ timestamp: { order: 'desc', unmapped_type: 'long' } }],
     },
   };
 
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
index 0d41ac0f46814..a8b68929e84b8 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
@@ -59,7 +59,7 @@ export function fetchLicenses(
         },
       },
       collapse: { field: 'cluster_uuid' },
-      sort: { timestamp: { order: 'desc' } },
+      sort: { timestamp: { order: 'desc', unmapped_type: 'long' } },
     },
   };