So all the logstash topics seem to come down to this error being related to not connecting to elastic search (timeout, wrong port, elasticsearch not running, etc).
I (thought I) verified that enterprise-search DOES have the right config and that elasticsearch is running.
Assuming I'm an idiot I decided to double check everything again...
Performing pre-flight checks for Elasticsearch running on http://172.0.0.1:10100...
yeah, that is supposed to be 127 not 172.
It would be cool if these underlying error conditions were handled and told the user what is actually going on...(e.g. "connection timeout trying to connect to 172...") as that would save a lot of guess and check.