15-20k logs / sec is serious data. Is the output buffer full before the processing buffer is full? If that is the case the OpenSearch is the bottleneck - you need to increase the performance here. If the output buffer is empty and processing fills up only your bottleneck is here. Then you should check your parsing for regexploits.