WARNING: Could not find logstash.yml

It's because Logstash usually looks for the file in your $LS_HOME/config directory. You can either start logstash with the flag --path.setting /etc/logstash or create a symlink. (see https://discuss.elastic.co/t/logstash-configuration-of-5-0-1/68883)

You passed logstash-syslog.conf to the -f parameter. -f expects a full path.

Your complete command-line statement for logstash should be:
./logstash -f /etc/logstash/conf.d/logstash-syslog.conf --path.setting /etc/logstash

1 Like