If I recall correctly Logstash file input plugin is single-threaded and can have performance problems when reading very large number of files. Filebeat was created espacially to handle this and can handle this better. I would recommend trying to use Filebeat, which should allow you to have considerably fewer worker threads and a smaller heap for your Logstash instance.