Depends on how you installed Logstash - a package manager should do all this for you.
If the user account exists: su - logstash -s /bin/bash
On the other hand, if there's no dedicated account, you are of course free to keep doing this as root (although I would recommend against it for principles of separation of duties in general).