It would help a lot if you could post the part of the log just after a restart so we can see what all is loading when logstash starts. Sometimes these kinds of errors do not present themselves directly so it takes looking at the startup logs to figure out what is going on.
Thanks,
Bryan