Logstash still holding onto deleted logstash application logs

That is the way UNIX filesystems work. A program can open a temporary file, delete it, then continue to use it for temporary storage until it exits, knowing that the filesystem will release the space when it exits, so it doesn't have to free it up itself (which might be impossible if it crashes). If you only have a couple of megabytes of memory (like the PDP-11 back in the 1970s) then the ability to extend storage to disk is sometimes useful.

Once this contract between the filesystem and the programmer was set (back in the 70's), it became impossible to change. The space used by a file is only freed when the last reference to it is deleted.