Pretty sure we're not making a brand new `/var/logs` directory when everything else goes into `/var/log`

Relates elastic#18305