It's a bit weird, but any way you can disable the swapping behaviour by enabling ]mlockall.
mlockall will try to lock the process address space into RAM, preventing
any Elasticsearch memory from being swapped out. This can be done, by
adding this line to the config/elasticsearch.yml file:
bootstrap.mlockall: true
Elastic HQ uses the following method to get the swap value:
formula:"stats.os.swap.used_in_bytes / 1024 / 1024"
IIRC, ES uses sigar to offer "stats.os.swap.used_in_bytes" and sigar uses "Paging Files" performance counter to finally get the number of bytes of paging files used by the ES.
You can double check this counter value by issuing
Get-Counter '\Paging Files\% Usage'
in windows power shell.