Thanks for your help. Didn't think about the Top5 being based on the last 500 and therefore easy to calculate.
In the meantime I found the culprit for sending my cluster into high load. The suggested values in the filter editor. Those are build from all values in all indices (regardles how old) and therefore obviously take a lot of time to generate. There was already a similar topic here in the forum:
I disabled the suggested values feature in Kibana and now I can enter search terms without creating the high load situation.
I'm already using a lifecycle policy but since I want to have 90 days of data queriable that's already quite a lot of data.
Best regards,
Sebastian