logging: replace rsyslog with logstash-forwarder

Also, localhost is incorrect here. I also need a better way to represent an empty list and check for that case. Forgot about that.