The CPUs aren't maxed out which means they're not the bottleneck here. Usually using spinning hard drives on database servers as opposed to flash drives should raise a red flag. There are valid reasons to go with HDDs, e.g. better cost efficiency for big data volumes. It comes with performance penalty regarding throughput though.
Did you monitor I/O stats on the Elasticsearch instance after you started sending data from Logstash? Are there any other processes running which Elasticsearch might compete with for I/O? If that's not the cause you'd need to dig deeper, e.g. if you're running a RAID array. The way the array is set up (things like block size and the like) can have an impact on read/write performance for some use cases.