Thank you so much for this great answer.
For now, we are doing a bunch of investigation and seem like problem exist, pretty sure it's some kind of rate limiting issue.
I am wondering if the script that use to get filebeat rate no longer works? Filebeat sending data to Logstash seems too slow
Is there any other solution to test the filebeat and logstash rate?