logging: replace rsyslog with logstash-forwarder

More key: value instead of key=value