Logstash watching Elasticsearch