Logstash hold indexes when ES is overloaded

That's really an elasticsearch question. If elasticsearch indexing slows down there will be back-pressure that will stop logstash sending it more data. It has been answered here. Not sure if things have changed. I do not run elasticsearch.