To clarify, Logstash was being downloaded by hand in the post_create.sh file, and then was stopped / restarted in the post_deploy.sh file. After experimenting it seemed to me the easiest way to deal w/ ES and Heka was to similarly download them by hand in the post_create.sh script, and so I added parallel restart code to post_deploy.sh. I did try a couple of other approaches, but ended up wrestling w/ permissions and file locations and other issues, probably at least partially due to my inexperience w/ awsbox.