let's curate the ES logstash log

Could you make this overridable? I think it's a sensible default, but we will likely need to reduce it in some instances, or temporarily when there is a log storm.