The default log4j2 configuration does not write to /var/log/messages. My guess is that you are running logstash as a service and systemd (or whatever service manager you use) is configured to forward its stdout to /var/log/messages. You could reconfigure systemd...