There is rsyslog service is running but that's Just receiving clint logs not not consuming high resources its at very optimise level and yes logstash is the owner of the files it is processing.
Would you mind sharing the link where it say permission issue, though here its not a issue.