Logstash memory consumption and swap memory issues

I suggest you get a heap dump when the OOM occurs. See this thread for what to do with the dump. This thread shows what the report will look like.