Am I misunderstanding if/else statements?

Your configuration looks correct. If you're storing your configuration file(s) in /etc/logstash/conf.d, do you have any other files there (like one with an elasticsearch output)? Logstash will read all files in that directory.