add a rsyslog config file to forward everything to logstash