Thank you for the reply @magnusbaeck !
I do get the correct output with rubydebug
https://gist.github.com/chrisan/7642d3c6a7c5c1b853495fccaef027c0 (I trimmed logstash-tutorial.log down to 10 rows)
Next I added back the elasticsearch output and ran the command with --debug https://gist.github.com/chrisan/6b1ad44ff4f1825582679b85f33755bd
It just keeps outputting the last few lines over and over.
I killed it after about 10 minutes and checked ES again. Still no indicies were created or searches worked. Out of curiosity I added a new line to logstash-tutorial.log and gave it today's date
126.96.36.199 - - [10/Oct/2016:05:13:43 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-dashboard.jpg HTTP/1.1" 200 321631 "http://semicomplete.com/presentations/logstash-monitorama-2013/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"
I briefly saw something different in the logstash debug output and now I have a new index for today as well as 1 record
$ curl 'localhost:9200/_cat/indices?v'health status index pri rep docs.count docs.deleted store.size pri.store.size yellow open logstash-2016.10.11 5 1 1 0 19kb 19kb
From my original gist I have
ignore_older => 0 and
start_position => beginning per the elastic.co guide
Any ideas from here?