It's because Logstash usually looks for the file in your $LS_HOME/config directory. You can either start logstash with the flag --path.setting /etc/logstash
or create a symlink. (see https://discuss.elastic.co/t/logstash-configuration-of-5-0-1/68883)
You passed logstash-syslog.conf
to the -f
parameter. -f expects a full path.
Your complete command-line statement for logstash should be:
./logstash -f /etc/logstash/conf.d/logstash-syslog.conf --path.setting /etc/logstash