moved logstash to puppet