logging: replace rsyslog with logstash-forwarder

Ah, the chained execution of restarts on a previously running resource would be a problem. Especially on systems with distributed state and consensus, similar to what we have seen with OVS.

With that in mind, how best should I handle this situation? Simply adding a `meta: flush_handlers` seems like it solves the immediate problem but doesn't feel like it solves the underlying ordering issue. If that's simply how it is done, okay, but I'm wondering if the final `service` call is misplaced. 

I can't place it specifically, something still feels 'off' to me about it.