The timeout occurs when waiting for the ACK/Heartbeat signal from logstash. The default timeout in filebeat is 60 seconds. If logstash is actively processing a batch of events, it sends a heartbeat-signal every 5 seconds.
Reasons why this signal is not received by filebeat can be either network or contention in logstash (induced by additional back-pressure on outputs). The beats input in logstash uses netty. Netty multiplexes multiple clients on N workers threads. Not sure the number of worker threads is configurable. The default is something like 2*number of CPUs I think. If the logstash pipeline is stalled (e.g. expensive grok or unresponsive output), the worker threads will have to wait. If the number of connections exceeds the number of available threads, the other connections will not be served (which might create a timeout in filebeat).
Upon failure filebeat reconnects. Seems like logstash still has these file descriptors for these connections open, as no errors has been read from these FDs yet. Clients/open FDs are not served. The input plugin has a setting to close inactive connections (default 30s).