added rsyslog; changed nsswitch in logstash to ignore etc/hosts