update diagram to make it clear that syslog drain output comes from the loggregator server not the traffic controller