What is the specification of your Elasticsearch cluster? Have you performed any benchmark to see what the throughput limit of Elasticsearch is? Have you tried replacing the elasticsearch output in Logstash with a file output to see if this changes the Logstash throughput?