set output in filebeat to file only - now filebeat works perfectly, 5700 events/s
Thats good. This indicates a problem with network or logstash. Which logstash version have you installed. There are known issues about beats input in logstash being slow when handling the protocol. Some background information in this post.
In fact I have many java apps on this machine, and load is ~30, but CPU usage is about 50%.
I don't understand. this any problem? cpu usage high, due to filebeat processing old logs on start?
On the other hand logs from syslog or other "normal" services are sent by filebeat normally, but there are no as many events in log file
which log files? filebeat missing log lines? Did you delete registry file between tests?