Ref T15 initial logstash forwarder role