I would like to give a final solution on this. The reason for getting out of memory kills by the kernel was elastalert that is using at peaks nearly double to much memory than Elasticsearch itself.
Sadly I do not know how to influence this bad behaviour of elastalert.
cheers