logging: replace rsyslog with logstash-forwarder

Isn't tcp/5000 in use by Keystone?