Fix proto and Rabbit syslog facility usage for logstash rsyslog template

- Assume the 1st rsyslog server node is also logstash node
- Assume the logstash proto is the same as 1st rsyslog server has
- Assume the USER facility is dedicated for RabbitMQ server

Change-Id: Ic71eadce83b4133afb6c0ff7d95b1303686e4b74
Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>