I'm also seeing this issue. I don't have sniffing enabled (according to the Logstash documentation it's disabled by default right?) and I've made sure the nodes advertised address in my Elasticsearch config matches that of the address used in the Logstash elasticsearch output plugin. Are we missing some obvious config option somewhere?