If you have installed Logstash from the deb package like me, you will notice that both logstash (agent) and logstash-web start themselves on boot under the logstash user. The usual removal/disabling via update-rc.d doesn’t work in this case.
To stop both of them from auto-starting you’ll have to edit the files located at: /etc/init/logstash.conf and /etc/init/logstash-web.conf. There, change the line reading “start on virtual-filesystems” to “start on never”. That’s it!
Pingback: Security-Vision » How to stop Logstash from auto-starting on boot()