Cannot run logstash as a service, with active pipeline

The only lines that should need adding are these:

node.name: logstash
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
path.logs: /var/log/logstash
xpack.monitoring.elasticsearch.url: "http://X.X.X.X:9200"
xpack.monitoring.elasticsearch.username: XXXXXX
xpack.monitoring.elasticsearch.password: XXXXXX

I note in your logstash.yml file that you have both node.name and log.level indented with a single space. YAML is indent-sensitive, as that indicates nested structures. Try removing the indents.