I have debug turned up on my filebeat (1.2.0-x86-64) and wanted to know if the following log lines are an indication of a tuning opportunity:
2016-04-25T18:34:13Z DBG output worker: publish 2048 events
2016-04-25T18:34:13Z DBG Try to publish 2048 events to logstash with window size 1024
just seeing these 2 messages is kind of out of context. without complete log I can not tell what's exactly happening. The window size does grow starting at 10 up to bulk_max_size. If logstash stops responding, the window-size will stop growing and might shrink instead.
Somewhat related: Logstash output load balancing and workers settings