Hello Moritz,
From my experience most of the CPU is probably used by logstash if you use the grok filter, I would advise you to put a load balancer in round robin in front of your two nodes so that the load of the parsing is balanced.
If Logstash is not the service taking most of the CPU, I am not sure if this setup would work so look on your node #1 what is the most CPU intensive service.
Good luck,
Antoine