The issue appears to be a combination of things:
- The build of CentOS 7 I have been given has noexec on /tmp which was an issue that stopped command line execution of logstash.
- The permissions around /etc/logstash and /etc/logstash.conf.d
These were set to root only, which might be fine for others but for me was a bad do.
I executed the following command:
setfacl -Rm d:u:logstash:rwX,u:logstash:rwX /etc/logstash
Which set rw on the directory and conf.d
Before when I was running Verbose from the command line I was getting a warning that the service could not find logstash.yml but it would start using a default.
When starting from SystemCtl the service would start but not listen
So after the line above I rebooted and made sure the logstash service was running and did a netstat -ntl
And to my delight discovered that logstash was now listening on port 5000 as hoped and that the listener persisted.
So at the moment this is a solved issue. I hope this helps someone else