I've just taken a look in the /var/log/logstash/logstash-plain.log file and it show the following message repeatedly:
[2017-05-05T14:18:25,111][INFO ][logstash.inputs.udp ] Starting UDP listener {:address=>"0.0.0.0:514"}
[2017-05-05T14:18:25,111][WARN ][logstash.inputs.udp ] UDP listener died {:exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:82:in `udp_listener'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.0/lib/logstash/inputs/udp.rb:56:in `run'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:425:in `inputworker'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:419:in `start_input'"]}
I realised the inbuilt syslog daemon was listening on 514 and have now disabled it; I no longer see those messages in the Logstash log. I still can't see the index pattern but will keep checking and update this post.