See T141776: Parsoid's service-runner events not showing up in Kibana since 2016-07-28 21:00 UTC. I first noticed this Saturday (30th July noon CT), but thought it was only Parsoid.
Looks like some monitoring of logstash service would be useful to ensure that we catch logstash service downtimes.