I don't think this is related to publish_async: true either... I think this is a problem with Loadbalancing in general, I don't get what thought...
I tried to split the batch with your suggested config but I still have the same problem, connection reset.
I will try to get this up and running in a test environment, I get too many logs to be able to turn on debugging on the Logstash indexers.
EDIT:
I forgot to mention in my first Post that we're sending the logs over the Internet. The logstash Indexers are located in another VPC and/or AWS account than the Filebeats.