Since we are replacing logstash100[1-3] with logstash100[7-9], all log producers which currently access one of the logstash node directly need to be reconfigured. Using the LVS endpoint is the obvious solution (logstash.svc.eqiad.wmnet).
A short tcpdump session indicates that the only log producers still using logstash100 are udp2log and elasticsearch. Elasticsearch restart is in progress, for udp2log https://gerrit.wikimedia.org/r/#/c/388426/ still needs to be merged. Another check will be needed before actually decommissioning those servers.
All reference to logstash100 have been removed from puppet. I'll still do a check that no traffic is coming to those servers (we might have something outside of puppet) and start decommisionning the servers.