correct default logstash user