As it happens I just wrote a few paragraphs about Logstash and "high availability":
For Elasticsearch HA comes by default, but for Logstash and Kibana we didn't realize and easy way to make it (yes we can use Linux OS Cluster approach), but project see that approach as no flexible
Kibana persists all state in Elasticsearch so you can just run it on multiple machines behind a load balancer. Kibana 4 basically just acts as a proxy to Elasticsearch so it's very lean on resources.
Most of your other questions are probably more Marathon questions than they are ELK questions. Logstash and Kibana can be viewed as pretty generic TCP (and possibly UDP) based services.