Magnus,
We can say authoritatively that the problem is NOT ES related. It is pure logstash failure.
This thread reflects where we have taken this so far (and the other poster is not us, it is another user with the same problem we have, but only today did we get another failure, and more log data, including:
[io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
java.io.IOException: Too many open files