You have about ~25k events per 30s send on the output side. That makes only <1000 events per second to LS which is rather slow. There can be different reasons for that like network, LS, ES. How many filebeat instances do you have sending to your LS instance?
Based on the above it makes a lot of sense that filebeat is keeping the files open as your setup does not keep up with the number of events sent. I doubt the limitation here is filebeat itself. You should investigate where the bottleneck in your architecture is. Check what network bandwidth you have, how many events you can get through 1 LS instance and your ES cluster. Perhaps you need to add bigger LS instances or add more?