What kind of configuration of ELK cluster do you have? For example, 3 nodes of elasticsearch, 2 nodes of logstash, 1 node of kibana? Elasticsearch is java application, you can configure heap settings to limit it. Something like this -Xms2g -Xmx2g and try to test it. Of course do it on dev stand )