I bounced logstash on deployment-logstash2 and looks like logs are flowing again, logstash-plain.log wasn't being written to before the restart which is a little worrying in itself and makes it non-obvious to understand what's wrong.

I'm resolving this for now but reopen if it happens again.

It's empty again :(

Resolving in favor of T205672: Elasticsearch puppet config changes broke puppet in various instances as the underlying cause is ES not logstash in this case.