Logstash 5 error output location non-intuitive when running as a service

[PhaedrusTheGreek]

When running Logstash 5 as a service, error output cannot be found at first glance. A users' first instinct is to check /var/log/logstash/, as this is historical behaviour, finding logstash-plain.log that contains only a partial story of Logstash's behaviour. E.g., in a situation where logstash won't start due to ruby syntax errors, logstash-plain.log appears to just start logstash over and over again like so:

[2016-12-05T12:28:34,702][INFO ][logstash.inputs.tcp      ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:34,796][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:28:54,521][INFO ][logstash.inputs.tcp      ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:54,590][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:29:20,872][INFO ][logstash.inputs.tcp      ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:29:20,965][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

For the real story, under upstart the log appears in /var/log/upstart/logstash.log by default, and in systemd under journalctl -u logstash.service

While interesting and educational, also might be annoying.

[PhaedrusTheGreek]

Also notable - logstash.conf parse errors and Ruby runtime errors both appear in logstash-plain.log