Logstash 5 error output location non-intuitive when running as a service

When [running Logstash 5 as a service](https://www.elastic.co/guide/en/logstash/current/running-logstash.html), error output cannot be found at first glance. A users' first instinct is to check `/var/log/logstash/`, as this is historical behaviour, finding `logstash-plain.log` that contains only a partial story of Logstash's behaviour. E.g., in a situation where logstash won't start due to ruby syntax errors, `logstash-plain.log` appears to just start logstash over and over again like so:

```
[2016-12-05T12:28:34,702][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:34,796][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:28:54,521][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:28:54,590][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2016-12-05T12:29:20,872][INFO ][logstash.inputs.tcp ] Starting tcp input listener {:address=>"0.0.0.0:2344"}
[2016-12-05T12:29:20,965][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
```

For the real story, under _upstart_ the log appears in `/var/log/upstart/logstash.log` by default, and in _systemd_ under `journalctl -u logstash.service`

While interesting and educational, also might be annoying.