logging: replace rsyslog with logstash-forwarder