logging: replace rsyslog with logstash-forwarder

Indentation is a bit weird here, any particular reason?