What you are describing (1 beat is fine... many beats are slow... ) would seem to indicate a significant backpressure / bottleneck then.
When Look closer you image your total rates are much higher than 500 EPS looks like it is 10-15K EPS. How many winlogbeats are you running? 10-15K EPS is still not a huge amount so I am unclear why you are seeing this but I might trying scaling first.
You might want to look at this and this
Do you see any 429 Rejections?
Can you scale up logstash and ES nodes maybe try twice as big and see?
Plus I would install metricnbeat on the logstash and elasticsearch nodes so that you can monitor the stack
Best practice is a separate cluster for the monitoring stack but you can probably point to your existing... except if it is overwhelmed then it does not help to monitoring there.