I recommend not using an empty logstash.yml, as it will be harder to change anything from the default. If you installed via an RPM/DEB (and the /usr/share/logstash path is a giveaway there), then the default is in /etc/logstash/logstash.yml. You should copy that and edit accordingly.