Enable --log.level trace. Direct the logs to a file, because there will be a lot of them. Once logstash has logged the "Successfully started Logstash API" message, wait 60 seconds. Then search the logfile for messages from the filewatch module. See here for an example. If you cannot understand the logs, post the messages from filewatch (not everything) either here, if possible, or on gist.github.com or another file sharing site.