I believe in the 6.x version (compared to 5.x) for Logstash that when you use the memory queue it no longer just uses the available memory of the OS but rather what you have predefined in $LogstashDir/jvm.options
I only say this just to prevent everyone from future questions/troubleshooting.
Also, I have ran into a few seasoned logstash folks who had no idea and or never thought to tune/change logstash's jvm.options
There is just a lot of emphasis on elasticsearch jvm.options that it is easy to forget/overlook logstash jvm.options
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.