Hmm, that is really weird.
Would you be able to do the following?
While you're ingesting data from Filebeat, can you run the command GET /_cat/thread_pool against the cluster? It should show what thread pools are actively being used and if there are any bottlenecks.
Also, would you be able to provide the output of GET /_cluster/stats?