Just ran the TCPDUMP, this is some of the output (all of it looks the same to me)
16:17:46.687340 IP elastic01.e4bh.internal.48727 > elastic01.e4bh.internal.wap-wsp: Flags [S], seq 4077433096, win 43690, options [mss 65495,sackOK,TS val 782129677 ecr 0,nop,wscale 7], length 0
16:17:46.687361 IP elastic01.e4bh.internal.48727 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 4288140784, win 342, options [nop,nop,TS val 782129677 ecr 782129677], length 0
16:17:46.687861 IP elastic01.e4bh.internal.48727 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 0:136, ack 1, win 342, options [nop,nop,TS val 782129677 ecr 782129677], length 136
16:17:46.688408 IP elastic01.e4bh.internal.48727 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 1013, win 358, options [nop,nop,TS val 782129678 ecr 782129678], length 0
16:17:46.890205 IP elastic01.e4bh.internal.46567 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 14770, win 1024, options [nop,nop,TS val 782129880 ecr 782128879], length 0
16:17:46.892187 IP elastic01.e4bh.internal.46559 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 9097, win 1024, options [nop,nop,TS val 782129882 ecr 782128880], length 0
16:17:47.567487 IP elastic01.e4bh.internal.48728 > elastic01.e4bh.internal.wap-wsp: Flags [S], seq 905487167, win 43690, options [mss 65495,sackOK,TS val 782130557 ecr 0,nop,wscale 7], length 0
16:17:47.567508 IP elastic01.e4bh.internal.48728 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 2283896919, win 342, options [nop,nop,TS val 782130557 ecr 782130557], length 0
16:17:47.568460 IP elastic01.e4bh.internal.48728 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 0:136, ack 1, win 342, options [nop,nop,TS val 782130558 ecr 782130557], length 136
16:17:47.568998 IP elastic01.e4bh.internal.48728 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 1013, win 358, options [nop,nop,TS val 782130558 ecr 782130558], length 0
16:17:47.620812 IP elastic01.e4bh.internal.46566 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 5850:5981, ack 8783, win 1024, options [nop,nop,TS val 782130610 ecr 782129108], length 131
16:17:47.621029 IP elastic01.e4bh.internal.46566 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 8870, win 1024, options [nop,nop,TS val 782130610 ecr 782130610], length 0
16:17:47.621733 IP elastic01.e4bh.internal.46770 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 5587:5795, ack 8530, win 1024, options [nop,nop,TS val 782130611 ecr 782129108], length 208
16:17:47.622468 IP elastic01.e4bh.internal.46770 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 8742, win 1023, options [nop,nop,TS val 782130612 ecr 782130612], length 0
16:17:47.623082 IP elastic01.e4bh.internal.46409 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 5649:5827, ack 16416, win 1024, options [nop,nop,TS val 782130612 ecr 782129110], length 178
16:17:47.623681 IP elastic01.e4bh.internal.46409 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 16503, win 1024, options [nop,nop,TS val 782130613 ecr 782130613], length 0
16:17:47.624746 IP elastic01.e4bh.internal.47576 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 6757:6904, ack 19605, win 1024, options [nop,nop,TS val 782130614 ecr 782129112], length 147
16:17:47.625380 IP elastic01.e4bh.internal.47576 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 22349, win 1010, options [nop,nop,TS val 782130615 ecr 782130615], length 0
16:17:47.690191 IP elastic01.e4bh.internal.48727 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 1013, win 358, options [nop,nop,TS val 782130680 ecr 782129678], length 0
16:17:48.570196 IP elastic01.e4bh.internal.48728 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 1013, win 358, options [nop,nop,TS val 782131560 ecr 782130558], length 0
16:17:48.622200 IP elastic01.e4bh.internal.46566 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 8870, win 1024, options [nop,nop,TS val 782131612 ecr 782130610], length 0
16:17:48.624189 IP elastic01.e4bh.internal.46770 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 8742, win 1024, options [nop,nop,TS val 782131614 ecr 782130612], length 0
16:17:48.626188 IP elastic01.e4bh.internal.46409 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 16503, win 1024, options [nop,nop,TS val 782131616 ecr 782130613], length 0
16:17:48.626190 IP elastic01.e4bh.internal.47576 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 22349, win 1024, options [nop,nop,TS val 782131616 ecr 782130615], length 0
16:17:48.894592 IP elastic01.e4bh.internal.46567 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 7893:8470, ack 14770, win 1024, options [nop,nop,TS val 782131884 ecr 782129880], length 577
16:17:48.895271 IP elastic01.e4bh.internal.46567 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 14990, win 1023, options [nop,nop,TS val 782131885 ecr 782131885], length 0
16:17:48.895546 IP elastic01.e4bh.internal.46559 > elastic01.e4bh.internal.wap-wsp: Flags [P.], seq 7571:8158, ack 9097, win 1024, options [nop,nop,TS val 782131885 ecr 782129882], length 587
16:17:48.895828 IP elastic01.e4bh.internal.46559 > elastic01.e4bh.internal.wap-wsp: Flags [.], ack 9317, win 1023, options [nop,nop,TS val 782131885 ecr 782131885], length 0
So from the looks of things logstash isn't doing anything then?