Good job trudging through this!
And now like I said I think it was something simple that we all did not see.
Did you install as a package?
And then you were running from the command line.
And like I said I should have seen this...
If you install as a package then run as a command line you have to add additional parameters to tell it where the config is at.
--path.settings /etc/logstash
This tells logstash where logstash.yml and pipeline.yml are at.
So the command should be
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf -r --path.settings /etc/logstash
If you look in the service startup file, you will see the command look like that.
If you had used tar.gz then your command would have worked.
I think if you set yourself all the way back and ran it like this it would work..
Also if you started it via the service it would work.
Now if you start logstash via the service /systemctl after you've moved everything you're going to run into another problem because they were looking /etc/logstash... And you will be out of sync and other frustrating situation may occur
What I would probably do is save off all your config files.... Completely uninstall the package and make sure it cleans up everything because now you moved files around.
Reinstall put all your correct config in the right place.
Try the command I showed above.
Then try starting as a service.
Apologies... Should have seen that