logging: replace rsyslog with logstash-forwarder

Thinking about this more, I don't actually believe this is an issue.

From what I checked into, `notify` is run at the end of the playbook. Thus, in either case when the service is stopped or started, the notify is queued up until the end of the entire task run, including the `service state=started