Typically, having more cores is better, and this might be the case for most workloads. Elasticsearch leverages having multiple cores available on the system by scheduling tasks across multiple CPUs; however, it doesn't require large amounts of CPU processing power as most of the operations are performed on files that are already indexed.
Most cloud providers (if you are deploying on the cloud) have increased rates for high CPU count virtual machines, to avoid unnecessary cost, size for a VM type that balances more memory than CPU.
When sizing for sufficient CPU resources, you should allow for some growth without having to change settings midway. For a small setup, something with at least two CPUs should be sufficient. For testing purposes and a small number of indexes/sources, even one CPU should suffice, but performance will suffer, especially if all of the components—Elasticsearch, Logstash, and Kibana—are deployed on the same system.