yes,,, however if i change the output to file based.. it works fine
so digging through some notes after the hardening we had to make a change to the java.options file, specifically:
set the I/O temp directory
-Djava.io.tmpdir=/var/log/logstash/tmp
i have a bunch of java files in dir's there with none of them are executeable though
logstash is owner and perms set to 0644