Meaning Elasticsearch Kibana logstash and filebeat all on the same server... Yes that's a lot.
Elasticsearch will attempt to claim half the RAM just for the JVM. If it's not there it's going to have problems.
That's going to compete with logstash that also wants RAM.
You should probably look at setting the JVM options to maybe 2 gigabytes each or something.
Long story short, I think you have resource competition.
At the very least, start Elasticsearch first... Then everything else... But you should really set the JVM options