Investigate indexing bottleneck

Elastic Stack Elasticsearch
3

Which version of Elasticsearch are you using?
5.1

Which EC2 instance types are you using? How large is the cluster?
3 x m4.xlarge

How many indices/shards are you actively indexing into?
indices are separated by month.
Each month index is about 140GB max with 5 shards.

What is the size of indices and shards being indexed into?
140GB max with 5 shards

Are indexed documents immutable or updated? If updated, how large portion of operations are updates?
The indexed document is totally new for the cluster. We insert with _bulk of 20000 in a batch.

Are your mappings static or dynamic?
mapping is static ,here is the mapping

{
"aliases": {

},
"mappings": {
  "changeling/models/logling": {
    "properties": {
      "id": {
        "type": "string"
      },
      "klass": {
        "type": "string"
      },
      "modifications": {
        "type": "string"
      },
      "modified_at": {
        "type": "date",
        "format": "dateOptionalTime"
      },
      "modified_by": {
        "type": "string"
      },
      "modified_fields": {
        "type": "string",
        "analyzer": "keyword"
      },
      "oid": {
        "type": "string"
      }
    }
  }
},
"settings": {
  "index": {
    "number_of_replicas": "1",
    "number_of_shards": "5",
    "refresh_interval": "60s"
  }
},
"warmers": {
  
}

}

Are you indexing in bulk? If so, what is your bulk size?
yes. 20000 in a batch
How many parallel indexing threads do you have against the cluster?
I used 3 processes in Linux, and allocate them to different CPU.