What does the cluster health look like? Do you by any chance have a very large number of shards as you have 7 shards and 1 replica as default for every index and generate index names based on a significant number of parameters in your Logstash configuration?