Logstash output traffic significantly higher than input (minimal transformations) + TCP RST

Can you share both logstash.yml and pipelines.yml ? This is your only pipeline right?

What do you have in Logstash logs? Any error regarding retries?