With the current load we are seeing multiple Java OOM failures for Elasticsearch per day and the boxes are so busy doing GC runs that they aren't keeping up with the inbound log traffic.
Each host is currently 16G; taking that up to 64G will help greatly.