add logstash::default to run_list