There could be a few issues. I'm running logstash on 3 production machines with Centos 7.3 Minimal. I had several issues to work through. But honestly, my biggest struggle was various java installers. This one below, which happens to be the one they recommend in the documentation, but I missed it several times reading through. Once you install it, you should get the following when running "java -version"
[elasticsearch@blf-logstash-001 logstash]$ java -version
openjdk version "1.8.0_121"
OpenJDK Runtime Environment (build 1.8.0_121-b13)
OpenJDK 64-Bit Server VM (build 25.121-b13, mixed mode)
There is also a chance that your logstash user doesn't have enough permissions to write to the log file location. So you can chown/chmod that directory. You can also try to give the logstash user sudo rights without password input in visudo:
sudo visudo
ADD LINE BELOW
logstash ALL=(ALL) NOPASSWD: ALL
Finally, make sure you have opened up port 9600/tcp on the firewall. Here is the command if you have firewall-cmd installed.
sudo firewall-cmd --permanent --add-port=9600/tcp
sudo systemctl restart firewalld
Hope these ideas help, we need to get that log writing so you can at least get some feed back. Can you post what you have for the yaml config? "/etc/logstash/logstash.yml"
