im getting a fresh box spun up without the CIS hardening and ill copy the configs across after installing logstash and run it then.
i suspect that will work and i have a sneaking suspicion its the hardening that's done something deep in the core of what log stash needs