logstash-forwarder role refactoring