This has been covered here many times before. In short you have two options:
- Monitor the sincedb file to check when Logstash has reached EOF, then kill Logstash.
- Use the stdin input instead. Logstash will shut down by itself when stdin has been closed and all inputs has been processed. On the flip side, it Logstash dies for whatever reason you don't know how much it has processed.
But why do you need to start and stop Logstash on demand? Can't you let it run all the time and process files as they arrive?