ES is rejecting documents, typically because they're malformed or are incompatible with the existing mapping. The Logstash log should contain additional information about this. Perhaps the dead letter queue feature could help you capture the rejected documents?