After increasing resources on each VM (4 cpu -> 6 cpu, 14gb ram -> 16gb ram) and adding some memory to es (ES_JAVA_OPTS: -Xms4g -Xmx4g --> -Xms6g -Xmx6g) everything became fine.
For example to other posters: cluster with 2 VM (esrch + graylog + mongo on each) processes about 100-120gb logs in day and 3000-5000 messages in a second during peak hours.
Add: and set refresh_interval for es from Graylog and index.refresh_interval