make sure the logstash user is set up no matter what, and allow appropriate duplicate role duplication
renaming of variables and separating the logstash run user from the lib/conf user
explicit perms
explicit owner/group for conf files
typos and making stuff up