Support new containerd CRI format

[kvch]

Containerd has a new cri log format which consists of 4 fields. But Filebeat only supports 3 fields.

Example log:

2018-06-26T01:37:58.748415561Z stderr F /usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:768: InsecureRequestWarning: Unverified HTTPS request is being made.

Filebeat creates this event from the log above:

"message": "F {\"@timestamp\":\"2018-06-26T01:37:58.748+00:00\",\"@version\":1,\"message\":\"...."}"

Note the character "F" before the JSON event.

Reference: containerd/cri#830 (comment)

[msvechla]

We have the same issue and are therefor unable to collect meaningful logs with filebeat from our upgraded kubernetes clusters.