logging: replace rsyslog with logstash-forwarder

Good point and agreed, thank you for mentioning a possible solution. I will add a card to split TLS and certs into a separate role.

This is also a different cert than the other certs which are provided.