It doesn't appear many folks that have had the same issue are getting much assistance, here's what I've done in order to increase throughput so far (back up to 1800 events/sec from 600, goal is getting back to ~2500);
-
Redirected Logstash output away from the Data Nodes, strictly pointed at client nodes. I wouldn't have thought to direct LS data towards Data Nodes, but it was instructed elsewhere in the forums.
-
Disable Scatter-Gather on the network cards. As instructed by other users with the same issue, I disabled this functionality of the network cards.
Between these two changes, the indexing rate appears to be getting back up to the typical rate.
I hope this helps others, please let me know if I missed anything or if you have any additional suggestions.