logging: replace rsyslog with logstash-forwarder

Why not do both of these in a with_items loop?