logstash: Update logstash for sending to es 2.x
Adjust index mapping template to be 2.x compatible:
- Remove path: full from geoip. This is now unsupported. full was already the default, and is what new versions of es always do so no other changes required.
- Remove 'index_name: tag' from tags. This was aliasing the tag field to tags. It is no longer supported in 2.x. Any dashboards that query tag must query tags instead now.
Post process logs to make them 2.x compatible:
- converts dot's in the properties into underscores. 2.x does not allow dots in properties, they are used as separators.
- Normalizes the pid and line fields into int. Some of the log types for nodejs services auto-created these as strings.
- Drops the extra timestamp field. @timestamp is definitive, and this timestamp field is seen sometimes as a date, sometimes as a string in the auto generated mappings depending on the content of the field the first time it was seen.