system-config/inventory/service/group_vars/elasticsearch.yaml

iptables_extra_allowed_groups:
  - {'protocol': 'tcp', 'port': '9200:9400', 'group': 'elasticsearch'}
  - {'protocol': 'tcp', 'port': '9200:9400', 'group': 'logstash'}
  - {'protocol': 'tcp', 'port': '9200:9400', 'group': 'logstash-worker'}