@dadoonet and @Christian_Dahlqvist you've helped me a lot. Thanks!
I've rebuilt my cluster, and it's now running much faster (Although I cant speak for stability yet).
I did this by setting my elasticsearch output index => "logstash-%{+YYYY.MM}" to a single index, rather than let it build a new index for each day.
My updated status:
-3 indices
-22 shards
-490,000 documents (currently)
-Heap usage is between 20% and 50%
So far it looks good, but I've discovered a strange issue of duplicate events.
I don't want to hijack this thread, so I created another here to explain the issue.
Maybe you might be able to have a look in there if you're interested.
Thanks.