logstash hung syslog

# http://unix.stackexchange.com/questions/195998/how-to-identify-why-a-process-wont-die

Apr 13 06:46:51 swat-logstash01 crontab[43205]: (root) LIST (logstash)
Apr 13 07:00:01 swat-logstash01 CRON[43241]: (logstash) CMD (/usr/local/bin/curator --host  delete --older-than 31 --prefix logstash- &> /dev/null)
Apr 13 07:17:01 swat-logstash01 CRON[43288]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Apr 13 07:19:32 swat-logstash01 crontab[44020]: (root) LIST (logstash)
Apr 13 07:50:33 swat-logstash01 crontab[44812]: (root) LIST (logstash)
Apr 13 08:00:01 swat-logstash01 CRON[44840]: (logstash) CMD (/usr/local/bin/curator --host  delete --older-than 31 --prefix logstash- &> /dev/null)
Apr 13 08:17:01 swat-logstash01 CRON[44886]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Apr 13 08:23:05 swat-logstash01 crontab[45626]: (root) LIST (logstash)
Apr 13 08:57:22 swat-logstash01 crontab[46425]: (root) LIST (logstash)
Apr 13 09:00:01 swat-logstash01 CRON[46439]: (logstash) CMD (/usr/local/bin/curator --host  delete --older-than 31 --prefix logstash- &> /dev/null)
Apr 13 09:17:01 swat-logstash01 CRON[46486]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Apr 13 09:32:26 swat-logstash01 crontab[47244]: (root) LIST (logstash)
Apr 13 10:00:01 swat-logstash01 CRON[47309]: (logstash) CMD (/usr/local/bin/curator --host  delete --older-than 31 --prefix logstash- &> /dev/null)
Apr 13 10:05:43 swat-logstash01 crontab[48051]: (root) LIST (logstash)
Apr 13 10:17:01 swat-logstash01 CRON[48085]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Apr 13 10:05:36 swat-logstash01 lsass: message repeated 301 times: [ [lsass] Error code 40286 occurred during attempt 0 of a ldap search. Retrying.]
Apr 13 10:36:13 swat-logstash01 crontab[49006]: (root) LIST (logstash)
Apr 13 11:00:01 swat-logstash01 CRON[49172]: (logstash) CMD (/usr/local/bin/curator --host  delete --older-than 31 --prefix logstash- &> /dev/null)
Apr 13 11:08:00 swat-logstash01 lsass: [lsass] Error code 40286 occurred during attempt 0 of a ldap search. Retrying.
Apr 13 11:08:08 swat-logstash01 crontab[50034]: (root) LIST (logstash)
Apr 13 11:17:01 swat-logstash01 CRON[50749]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)