The answer is
[TRACE][filewatch.discoverer ][eslogs][bc5ab04f2d956de5667fd6d17f303124efa9f39b777b88a02840b4c697a8bf3a] discover_files {:count=>0}
count=>0 means it is not finding any logs that match the path option of the file input. Possibly when you run on the command line you have different permissions, perhaps via group memberships, compared to the user running the service.