Thanks for help! I'm not sure whether my way to verify where the delay is is right or not.
Right now Filebeat are running on 10 machines. Logstash is on another machine in the same network. Let's take one line of log as an example.
Here the field '@datetime'(11:51:41,387) is when the log is generated. It is parsed from the log. The field '@timestamp'(11:51:44.801) is generated by Filebeat(I think it is?), so I think it's the time when Filebeat sent the message. And the field '@collected_time'(11:51:45,905) is a field I put at the end of Logstash. The configuration is
code => 'require "date"
current_time = DateTime.now
t = current_time.strftime("%d/%m/%Y %H:%M:%S,%L")
In this case, I think the gap between @timestamp and @datetime is relatively large.