The config is fairly large to copy and paste and it isn't giving me a line number. And if I try it with --configtest, it surprisingly passes.
I did remove the entire filter {} section and it worked so it is not happy with something there.
I added this to the beginning of every grok stanza, to be safe, following an issue I found on github:
patterns_dir => "/etc/logstash/patterns"
I've already updated to change "host" to "hosts" since I saw that in the incompatible changes. That's not the problem here, but thanks for the suggestion.
Might it have anything to do with this? Grok -> patterns_dir not working in logstash 1.5.0 Do I need to install a plugin to access the patterns included with logstash by default?
Edit: confirmed that %{HOST} is a built-in pattern (or at least grok debugger says it is): https://grokdebug.herokuapp.com/patterns# (look under grok-patterns)
Edit2: I am not confident that it is related but the logstash log is filling up with permission denied errors like this one for local files:
{:timestamp=>"2015-11-11T06:28:13.624000-0500", :message=>"failed to open /var/log/syslog: Permission denied - /var/log/syslog", :level=>:warn}