Ok - so I ran it...
I think it's still running.
Anyways - here's what came back:
/usr/share/logstash/bin# ./logstash -f json.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2019-08-04 09:19:00.786 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2019-08-04 09:19:00.810 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.8.1"}
[WARN ] 2019-08-04 09:19:11.467 [Converge PipelineAction::Create<main>] elasticsearch - You are using a deprecated config setting "document_type" set in elasticsearch. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Document types are being deprecated in Elasticsearch 6.0, and removed entirely in 7.0. You should avoid this feature If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"document_type", :plugin=><LogStash::Outputs::ElasticSearch index=>"json_test", id=>"42a0ffc6c2f9eb89b77c0068e554dabedb6d72311d1e93ee7d792c354934dee7", hosts=>[//10.2.20.21:9200], document_type=>"json", enable_metric=>true, codec=><LogStash::Codecs::Plain id=>"plain_bccad9aa-960d-41d5-ab10-4de9097e104d", enable_metric=>true, charset=>"UTF-8">, workers=>1, manage_template=>true, template_name=>"logstash", template_overwrite=>false, doc_as_upsert=>false, script_type=>"inline", script_lang=>"painless", script_var_name=>"event", scripted_upsert=>false, retry_initial_interval=>2, retry_max_interval=>64, retry_on_conflict=>1, ilm_enabled=>false, ilm_rollover_alias=>"logstash", ilm_pattern=>"{now/d}-000001", ilm_policy=>"logstash-policy", action=>"index", ssl_certificate_verification=>true, sniffing=>false, sniffing_delay=>5, timeout=>60, pool_max=>1000, pool_max_per_route=>100, resurrect_delay=>5, validate_after_inactivity=>10000, http_compression=>false>}
[INFO ] 2019-08-04 09:19:11.546 [Converge PipelineAction::Create<main>] pipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[INFO ] 2019-08-04 09:19:12.224 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://10.2.20.21:9200/]}}
[WARN ] 2019-08-04 09:19:12.539 [[main]-pipeline-manager] elasticsearch - Restored connection to ES instance {:url=>"http://10.2.20.21:9200/"}
[INFO ] 2019-08-04 09:19:13.335 [[main]-pipeline-manager] elasticsearch - ES Output version determined {:es_version=>6}
[WARN ] 2019-08-04 09:19:13.340 [[main]-pipeline-manager] elasticsearch - Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>6}
[INFO ] 2019-08-04 09:19:13.397 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//10.2.20.21:9200"]}
[INFO ] 2019-08-04 09:19:13.402 [Ruby-0-Thread-5: :1] elasticsearch - Using default mapping template
[INFO ] 2019-08-04 09:19:13.516 [Ruby-0-Thread-5: :1] elasticsearch - Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[INFO ] 2019-08-04 09:19:14.111 [[main]-pipeline-manager] file - No sincedb_path set, generating one based on the "path" setting {:sincedb_path=>"/usr/share/logstash/data/plugins/inputs/file/.sincedb_794f8fd11acdfc7933430a216d92f250", :path=>["/usr/share/logstash/misp-data.json"]}
[INFO ] 2019-08-04 09:19:14.158 [Converge PipelineAction::Create<main>] pipeline - Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0xc0f6a15 run>"}
[INFO ] 2019-08-04 09:19:14.259 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2019-08-04 09:19:14.277 [[main]<file] observingtail - START, creating Discoverer, Watch with file and sincedb collections
[INFO ] 2019-08-04 09:19:14.784 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
java.lang.OutOfMemoryError: Java heap space
Dumping heap to java_pid4378.hprof ...
Heap dump file created [1113405528 bytes in 20.444 secs]
Exception in thread "Ruby-0-Thread-11: :1" java.lang.OutOfMemoryError: Java heap space
Exception in thread "[main]>worker0" java.lang.OutOfMemoryError: Java heap space
Exception in thread "[main]>worker2" java.lang.OutOfMemoryError: Java heap space
Exception in thread "Ruby-0-Thread-14: :1" java.lang.OutOfMemoryError: Java heap space
Exception in thread "Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6" java.lang.OutOfMemoryError: Java heap space
No [ERROR] so far at least...
I checked the jvm.options file. Heap was set to 1g. The file is larger than that. I set it to 4g. Rebooting the box and running the .conf again.