High cpu usage by worker thread

40% CPU usage for 1000 msg/s definitely seems high, but it depends on the grok expression and the kind of CPU.

If you're feeding the messages into Elasticsearch you can e.g. use the kopf plugin to monitor the ingestion rate. Otherwise, just measure how long it takes to process a known amount of messages. However, unless there's a reason to believe that Logstash is falling behind and can't keep up with the input rate (unlikely unless the CPU(s) are saturated) the output rate will by definition match the input rate.