If logstash detects a crash in the TCP input and shuts it down; logstash continues to run (an monit thinks everything is ok) even though logstash is no longer accepting traffic.
This should be detected as a failure condition by monit and logstash should be restarted.