The issue, as with most, was user error. I had the test data in my home directory and logstash user could not read it. Once I fixed the permissions it worked as expected.
NOTE: nothing in the logs indicated a read error, maybe some sort of error logging indicating read failures would be helpful.
Thanks again for the assistance.