moved logstash package up so it installs before things start trying to use the logstash user