gistfile1.txt

dylan@salt /srv/salt (internal-ip-nginx-endpoint●)$ _ salt '*' grains.item roles
logstash_staging:
  roles: {'logstash-reciever': True, 'elasticsearch': True, 'logstash': True, 'kibana': True}
logstash_ops:
  roles:
      logstash-reciever
      logstash
      elasticsearch
      kibana
dylan@salt /srv/salt (internal-ip-nginx-endpoint●)$ _ salt -G 'roles:elasticsearch' test.ping
logstash_ops:
    True

top.sls

base:
  'roles:(elasticsearch|kibana)':
    - match: grain_pcre
    - data-volume

  '*':
    - salt
    - main
    - dylan-user
    - nginx
    - nginx.internal-endpoint

  'roles:elasticsearch':
    - match: grain
    - elasticsearch

  'roles:logstash-reciever':
    - match: grain
    - redis.server
    - logstash
    - logstash.curator

  'roles:logstash':
    - match: grain
    - logstash
    - logstash.curator

  'roles:kibana':
    - match: grain
    - logstash.kibana

For all this, highstate only runs '*' against both logstash_ops and logstash_staging.