Ha! I went to clean it up and turns out the template was already directly referencing `node['rsyslog']['protocol']`.