logging: replace rsyslog with logstash-forwarder

In cases where boot strap and ongoing configuration are handled in the same set of plays, then the standard pattern I've seen is to flush handlers before the task to ensure the service is enabled/running. That enabled/running task should be the last task in the play, so that all the configuration of the service is done before the handler flush and the service start up.