Using the elasticsearch_river output, it's easily possible to try to write out AMQP frames which are too large for rabbitmq (default is 120k).
This breaks everything, as logstash continually connects and tries to publish the poison message.
Instead, logstash should respect the max frame size negotiated with the AMQP server, and send large messages as multiple frames.
It's possible to work around this in RabbitMQ, by setting:
in the rabbitmq.config
But it would be better if the AMQP client used was spec compliant (and broke larger messages up into multiple AMQP frames).