with these errors:
systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2017-05-09 16:47:39 EDT; 12min ago
Main PID: 26787 (java)
Tasks: 70 (limit: 512)
CGroup: /system.slice/logstash.service
└─26787 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: at org.jruby.Main.main(Main.java:197)
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: Caused by: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@4f4ba7d7
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:75)
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:81)
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:103)
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: at org.apache.logging.log4j.core.appender.RollingFileAppender.createAppender(RollingFileAppender.java:191)
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: ... 105 more
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Null object returned for RollingFile in Appenders.
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Null object returned for RollingFile in Appenders.
May 09 16:47:46 jeffforbes2.nacon.com logstash[26787]: 2017-05-09 16:47:45,983 main ERROR Unable to locate appender "plain_rolling" for logger config "root"
When logstash is started from the command line the logging to /var/log/logstash works correctly.