Convert Filebeat postgresql.log to ECS

[webmat]

Caveats

• Module used to keep original message in message, and cleaned up message in postgresql.log.message. Keeping original message will be addressed elsewhere, and this PR now replaces message with the cleaned up message.
• This module previously named the PID as postgresql.log.thread_id, which is incorrect. PG cannot log thread ID, it's not an option. This PR names the PID as process.pid
• The PG logs contain timestamps without a timezone, as well as a separate timezone field. This module doesn't leverage the timezone field and parses the timestamp as UTC. Properly implementing support would require a module option to enable/disable timezone usage. I consider this out of scope for this field name transition.

Renames

• postgresql.log.level => log.level
• postgresql.log.user => user.name
• postgresql.log.thread_id => process.pid
• postgresql.log.timezone => event.timezone
• postgresql.log.message => message

TODO

• Coerce PID to int
• Coerce duration to float
• Save cleaned up message in message field
• Copy postgresql.log.duration * 1000000 to event.duration
• Migrate the timezone field as well
• Make the new core_id field an int as well
• Alias renamed fields to their ECS counterpart
• Document field migrations in ecs-migration.yml
• Changelog

[ruflin]

+1 on both Caveats

[webmat]

Ready for another look. There's one new caveat about the timezone field.

[webmat]

jenkins, test this please